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Dear Sir: 


Pursuant to sub-section 273.63 (3) of the National Defence Act, I am pleased to 
submit to you my 2003-2004 annual report on my activities and findings, for your submission to 
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TRODUCTION 


This is my first report as Communications Security 
Establishment (CSE) Commissioner following my 
appointment on June 19, 2003. 


During my twenty years on the Supreme Court of 
Canada, ten of them as Chief Justice, I witnessed 
and participated in the evolution of human rights 
and freedoms in this country, as we grappled with 
the application and impact of the Canadian Charter 
of Rights and Freedoms. This experience dovetails 
very well with my duties as CSE Commissioner, 
because safeguarding the rights of Canadians, 
including in particular the right to privacy, is an 
important element, although not exhaustive, of 
my mandate. In accepting this order-in-council 
appointment last June, therefore, I was honoured 
and pleased to have the opportunity to continue 
serving my country in a meaningful way. 


Since retiring from the Court, I have participated 
in independent reviews and inquiries. One lesson 

I took from those experiences was the value of 
working collaboratively when seeking change 

and reform. With this background, my approach to 
reviewing the activities of the Communications 
Security Establishment is essentially proactive and 
preventive. When reviewing CSE operations to 
ensure that no unlawful activity has occurred, I also 
look for the existence of preventive counter- 
measures to safeguard against situations arising in 
which unlawful activity could occur. In areas as 
vital as security and intelligence where Canadians’ 
privacy is at stake, I believe this approach is not 
only warranted but essential in establishing the 
appropriate balance between the demands of 
security and intelligence and the privacy rights 

of Canadians. 


Under this approach, if I had concerns as a result 
of a review conducted by my office, my first step 
would be to share those concerns with the relevant 
persons — the Chief of CSE and those who report 
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to him. This would afford them an opportunity to 
institute corrective measures or to explain to me 
why my concerns were unjustified. By proceeding 
in this way, it is my hope that when I submit 
classified reports to the Minister of National 
Defence, most of the problem areas I have 
identified will already have been addressed, 

and my report will have been rendered moot. 


This approach has proved useful in the past, often 
resulting in prompt administrative action. As a 
result, it has been possible to improve the way 
things are done expeditiously and without 
confrontation. In this way, the review and reportin 
process becomes a vehicle not just for detecting 
unlawful activity but for preventing it in the first 
place. When constructive criticism is accepted in 
the spirit in which it is intended, this approach 
works to the benefit of all concerned. 


THE YEAR IN To prepare myself for the work ahead, in the first 
ew months after my appointment I received sever 


REVI EW briefings from my own staff and from officials at 
CSE, including meetings with the Chief and his 
executive team. I met with the Minister of Nation: 
Defence as well as his predecessor. I also met witl 
the Security Intelligence Review Committee and 
with the Security and Intelligence Coordinator, wl 
is also the National Security Advisor to the Prime 
Minister, and to whom the Chief of CSE reports f 
matters of operations and policy. 


What quickly became apparent to me was the 
array of challenges facing CSE and the rest of the 
intelligence community in light of globalized | 
threats with implications for Canada’s internation. 
affairs, defence and security. The need to monitor 
and understand these threats 1s vital, yet efforts to 
do so have been curtailed in recent years by what. 
has become an increasingly complex web of glob! 
communication technologies. Significant | 
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challenges to foreign intelligence collection — one 
of CSE’s primary mandates — also arise in this 
environment. ! 


These and other new demands led to legislative 
amendments and the development of new legal 
frameworks that should meet two objectives: first, 
facilitating the activities of intelligence agencies; 
and second, requiring that those agencies meet 
certain standards and respect certain thresholds 
that allow them to define and account for their 
activities. 


In parallel with technological development to permit 
foreign intelligence collection in an ever expanding 
and complex global communications environment, 
it is also important to develop technologies that 
enable intelligence agencies to protect the rights and 
privacy of Canadians. In other words, technology 
developed for purposes of acquiring information 
from the global information infrastructure must be 
complemented by technology that can be used to 
protect privacy. It is in this context that the need for 
review of CSE’s activities remains high. 


Against this backdrop, several general issues 
related to foreign intelligence collection drew my 
attention in the past year; two in particular warrant 
discussion here. 


Canada’s intelligence requirements, including its 
foreign intelligence priorities, are established 
annually by the Ad Hoc Committee on Intelligence 
Priorities (formerly the Meeting of Ministers on 
Security and Intelligence), chaired by the Prime 
Minister. Several federal agencies, including the 
Communications Security Establishment, 
contribute to meeting these priorities. 


| Foreign intelligence is defined in the National Defence Act as information 


or intelligence about the capabilities, intentions or activities of a foreign 
individual, state, organization or terrorist group, as they relate to 
international affairs, defence or security (Part V.1, section 273.61). 
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To carry out its foreign intelligence mandate, the 
CSE relies on the authority of the National Defence 
Act (NDA),* which empowers CSE to “acquire and 
use information from the global information 
infrastructure for the purpose of providing foreign 
intelligence, in accordance with Government of 
Canada intelligence priorities”. When CSE does 
this, it is acting as a principal provider of foreign 
intelligence. 


In addition, CSE, under the authority of the NDA, 
assists other federal agencies in the performance of 
their lawful duties. In these instances, CSE does so 
as an agent. In providing technical and operational 
assistance to federal law enforcement and security 
agencies, CSE is strictly governed by the terms and 
conditions of the principal’s governing authorities, 
which in some instances may be a warrant from the 
Federal Court of Canada. 


These two roles — as principal and agent — were 
formalized in legislation in 2001, but they are not 
new for CSE. What is new is CSE’s authority 
under the NDA to intercept private communications 
under prescribed conditions, if authorized to do so 
by the Minister of National Defence. With a 
ministerial authorization, CSE can intercept and 
use a communication with a connection to Canada 
(that is, a ‘private communication’) acquired in 
the course of targeting a foreign entity abroad, 
provided it meets certain conditions laid out in the 


2 R.S.C. 1985, c. N-5. 
3 Private communications are the communications of Canadians or persons i 
Canada. Specifically, private communication is defined in section 183 of 
the Criminal Code as any oral communication, or any telecommunication, 

that is made by an originator who is in Canada or is intended by the 
originator to be received by a person who is in Canada and that is made 
under circumstances in which it is reasonable for the originator to expect | 
that it will not be intercepted by any person other than the person intended | 
by the originator to receive it, and includes any radio-based telephone 
communication that is treated electronically or otherwise for the purpose 0 
preventing intelligible reception by any person other than the person | 
intended by the originator to receive it. 
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NDA. This provision adds a new authority to the 
legal framework within which foreign intelligence 
can be lawfully acquired. 


From my initial review of some foreign intelligence 
collection activities, I had concerns that, in some 
instances, the linkages between these activities 

and the authorities that govern them were not 

being given due consideration. I was pleased to 
learn, therefore, that during the past year the legal 
frameworks available to the intelligence community 
for foreign intelligence collection were revisited to 
ensure that all available authorities had been fully 
considered before foreign intelligence activities 
were authorized. I encourage the government to 
continue to do so. 


Historically, governments have relied on intelligence 
gathering as part of their efforts to protect and 
promote national interests and to identify and 
counter threats to those interests. The advent of new 
technologies, along with revolutionary developments 
in the communications industry over the past 
decade, have hindered some traditional forms of 
intelligence collection, including the foreign signals 
intelligence collection performed by CSE. 


In the not so distant past, foreign intelligence 
collection was fashioned around predictable 
communications patterns and technologies. As a 
result, it could be conducted within relatively 
neatly defined legal frameworks. This environment 
facilitated the review and assessment of foreign 
intelligence collection activities. During my first 
year as CSE Commissioner, however, I quickly 
understood that this is no longer the case. 
Governments have had to reassess their ability to 
protect national interests and counter activities 
such as terrorism that threaten domestic and 
international security. Canada is no exception. 
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New legal mechanisms were needed to respond to 
this changing environment. One response was the 
ministerial authorization (MA) provisions in 

Part V.1 of the National Defence Act, added to 

the Act in 2001.4 


Today’s integrated technologies carry different kind 
of traffic and follow complex communication paths 
that transit international borders and mix foreign 
communications with private communications. 

The MA provisions do not allow CSE to target 
Canadians or their communications. (CSE has neve 
been allowed to do this.) Today, however, CSE is in 
a better position to fulfil its foreign intelligence 
responsibilities because, with the Minister’s consent 
it can follow targeted foreign communications even 
if they have a connection with Canada. I believe tha 
few Canadians would disagree with the intent of thi: 
provision and the authority it provides in today’s 
context of terrorism and threats to Canadians’ safety 
and security. 


Since the new legislation was passed, I can confirm 
that CSE has exercised this authority. As CSE 
Commissioner, I understand the need for it and 
support its objective. Subsection 273.65 (8) of the 
NDA requires that I review CSE activities carried 
out under an MA to ensure that they are authorized 
and report annually to the Minister. 


4 Part V.1 was added to the National Defence Act by the Anti-Terrorism Act, 
which became law on December 24, 2001. Before issuing a ministerial 
authorization, the Minister must be satisfied that the four conditions set ou 
in subsection 273.65 (2) of the NDA have been met: 

(a) the interception will be directed at foreign entities located outside 
Canada; 

(b) the information to be obtained could not reasonably be obtained by 
other means; | 

(c) the expected foreign intelligence value of the information that would b 
derived from the interception justifies it; and | 

(d) satisfactory measures are in place to protect the privacy of Canadians | 
and to ensure that private communications will only be used or retaine 
if they are essential to international affairs, defence or security. 
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I believe CSE’s policies, instruments and processes 
must require and facilitate the management and 
accountability of any activities it conducts under 
the authority of an MA, particularly activities that 
relate to intercepting private communications and 
safeguarding the privacy of Canadians. While this 
is an evolving process, I can report that CSE has 
continued to improve the MA structure and 
strengthened the MA management and 
accountability mechanisms. 


The Auditor General’s November 2003 report was 
tabled in Parliament on February 11, 2004. 
Chapter 10 of the report — Other Audit 
Observations — included an audit note, headed 
Independent reviews of security and intelligence 
agencies, that went on to state, “The activities of 
security and intelligence agencies are not subject 
to consistent levels of review and disclosure.” 


The report suggested that the CSE Commissioner’s 
annual report should be expanded beyond 
considering CSE’s compliance with the law to 
include such topics as management issues or 
potential problems at CSE. I believe that a review 
of the annual reports produced by this office to 
date will confirm that these areas have, in fact, 
been considered as they relate to two of the 
organization’s business lines, foreign intelligence 
collection and the protection of government 
information systems and networks. 


For example, over the past several years, reviews 
have led to observations in such areas as CSE’s 
strategic planning activities; internal policies, 
procedures and handling practices; and management 
and control frameworks. These observations have 
always been made, however, in the context of 
lawfulness and CSE’s efforts to safeguard the 
privacy of Canadians. 
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I believe the content of the CSE Commissioner’s 
public annual report must be guided by his mandate, 
which is to review and report on CSE’s activities to 
ensure that they are in compliance with the law, and 
to report to the Minister of National Defence annualls 
on the Commissioner’s activities and findings. 


I submitted a total of five classified reports to the 
Minister of National Defence over the period 
covered by this report. Two of these were initiated 
by my predecessor and completed during the first 
year of my term. 


In 2003-2004, I submitted three classified reports to 
the Minister of National Defence on subjects relatec 
to my general mandate to review CSE’s activities to 
ensure they conform with the law. 


Submitting a classified report to the Minister does 
not mean that a lack of compliance with the law or 
ministerial authority has been detected. It indicates 
only that the report contains material that requires 
classified handling. I report to the Minister on all 
my reviews, either to provide assurance or to 

bring concerns to his attention, as each specific 
situation requires. 


CSE conducted activities under seven ministerial 
authorizations in 2002-2003; two of these concerne: 
foreign intelligence collection, while five related to 
information technology security. Within the time 
frame covered by this report, my office reviewed 
activities under five of the MAs; the others were 
nearing completion at the end of the reporting year. 
The five reviews resulted in two reports to the 
Minister, both covering information technology 
security activities. 


None of the reports raised issues of unlawfulness. 


Review of past 
recommendations 
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However, a more general issue about the structure 
of and process for using ministerial authorizations 
did arise. Certain weaknesses in policies and 
procedures related to these activities were brought 
to CSE’s attention. While some issues have been 
resolved, others remain. I hope to be able to report 
further on these issues in next year’s report. 


Annex C provides a list of all classified reports to 
the Minister submitted by my predecessor and me 
since the Commissioner’s office was established 
in 1996. 


This year my staff reviewed all recommendations 
made by my predecessor and me in classified reports 
submitted to the Minister of National Defence since 
the creation of this office in 1996. The goal was to 
follow up with CSE on these recommendations and 
to determine whether the issues identified had been 
dealt with satisfactorily. I will be asking CSE for an 
annual update of this information. 


The review showed that CSE’s response to the 
recommendations has not been uniform. This is 
not surprising, given the diverse nature of the 
recommendations made to date: some could be 
implemented immediately; some related to policy 
or procedures; some were of a technical nature; 
and some required further study to determine their 
feasibility. Many related to how CSE can better 
manage and account for its activities. 


Based on this review, I would observe that CSE 

has responded to many of the Commissioner’s 
recommendations, but that a number of issues 
remain to be addressed, in particular, by establishing 
work plans and timetables with milestones and 
completion dates for specific corrective actions 

that CSE has acknowledged are necessary. 


As I have made clear throughout this report, my 
recommendations and those of my predecessor are 
intended generally to be preventive, to forestall the 


A ES 


possibility of non-compliance by putting effective 
controls in place. It is in this spirit that I will 
continue to follow up on CSE’s response to 
recommendations from my office. 


2003-2004 Findings I can report that the activities of CSE that my office 
reviewed during the past year complied with the 
law and with ministerial authority. It is important 
to place this assertion in context. It should not be 
taken to mean that I am certifying that all CSE’s 
activities in 2003-2004 were lawful. I cannot make 
this assertion, because I did not review all their 
activities — and no independent reviewer could. 
However, my office reviews a wide range of 
activities in considerable depth, based on our 
assessment of where the risks of unlawful activity 
are likely to be greatest. This is the appropriate 
context for the assurance my work provides. 


I should add, however, that during the course of 
reviews, I occasionally identify circumstances where 
there are clear and evident risks that unlawful activity 
might occur (arising, for example, from deficiencies 
in policies or practices). My predecessor and I have 
made a practice of reporting these circumstances to 
CSE and to the Minister. As I made clear in the 
introduction to this report, I believe it is ultimately 
more useful to prevent unlawful activity than to 
identify it after the fact. 


Complaints and There were two complaints in the period covered 
concerns about by this report, but neither led to a formal 


CSE activities vestigation. 


If I am to be in a position to assure complainants 
that CSE is not engaging in unlawful activity, my | 
approach to complaints must take into account the 
mandate assigned to CSE under Part V.1 of the 
National Defence Act. Now, as before the 
introduction of Part V.1, CSE must not target 
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the communications of Canadians or persons in 
Canada. As discussed earlier, however, it is no 
longer possible to state unequivocally that both 
ends of a communication intercepted by CSE are 
foreign. CSE can now intercept (though it cannot 
target) private communications, provided it obtains 
a ministerial authorization in advance. CSE may 
also use and retain that communication, provided it 
adheres to guidelines that are also established in 
Part V.1 of the NDA (see footnote 4). 


Any complaint submitted to me about CSE’s 
activities must therefore be examined in this light. 


No persons approached me to avail themselves 
of the public interest defence provisions of the 
Security of Information Act, subparagraph 15 
(5)(b)(ii).° 


Since 1996, when the position was first created, 
the mandate of the Communications Security 
Establishment Commissioner — and hence the 
staff and other resources required to carry out that 
mandate — have undergone considerable 
evolution. Between June 1996 and December 2001, 
the Commissioner’s role was twofold: to review 
CSE’s activities to determine whether they 
conformed with the law, and to receive complaints 
about the lawfulness of CSE activities. 


As discussed at length in previous annual reports 
and alluded to earlier in this report, two features of 
the Anti-Terrorism Act of December 2001 had a 
direct bearing on the Commissioner’s functions: 
the review of CSE activities conducted under 
ministerial authorization and the Commissioner’s 
duties under the Security of Information Act. 


5 R.S.C. 1985, c. O-5. 
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To fulfil these new responsibilities, my office was 
allocated additional resources to carry out review 
activities. À bigger workload and more staff have 
affected the way we organize and manage our 
work. For example, our internal policies and 
procedures for managing the office have been 
enhanced to reflect the maturation of the 
organization and the increase in staff during the 
fiscal year. 


We have also paid attention to our work methods. 
Tools such as a standardized methodology, scope 
statements, and guidelines structure our reviews of 
CSE’s activities in such a way that all reviewers 
are working to the same standards of rigour and 
thoroughness. With the addition of more staff 
involved in these endeavours, my office has 
embarked on an initiative to record and document 
these processes wherever possible. 


With a new Commissioner and the evolution of the 
Commissioner’s mandate over the past three years, 
it was time to look at how my office relates to the 
broader context in which it operates — in particula 
the federal government community and the security 
and intelligence community in Canada and 
internationally. A communications plan, developed 
this year with input from key players in Canadian 
intelligence, will help guide my office through the 
rapidly evolving intelligence and policy worlds. 


For example, one objective of the plan is to 
communicate more regularly and systematically 
with interested groups and individuals — including 
the Canadian intelligence community, organization: 
that deal with intelligence issues, and academics 
specializing in the intelligence field — about the 
nature of my mandate, my approach to the job, and 
the activities of my office. This type of interaction 
could lead, for instance, to productive partnerships 
with academic specialists in areas of mutual interes 
and concern. In addition, conveying accurate, 
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timely information about the office will help avoid 
misunderstandings or speculation about who we 
are and what we do. 


Among the first steps in implementing the plan 
were my meetings with the current and former 
Ministers of National Defence, the chair and 
members of the Security Intelligence Review 
Committee, and the National Security Adviser to 
the Prime Minister, mentioned earlier. 


In addition, my staff met with academics specialized 
in security and intelligence matters and participated 
in meetings of the Canadian Association of Security 
and Intelligence Studies. My staff also took steps 
toward greater participation in the public service 
community — notably through meetings with other 
small agencies, particularly those whose mandates 
include reviews and complaints. 


With regard to the broader security and intelligence 
community, my office received visiting 
parliamentarians from Sweden and the United 
Kingdom — both countries with similar concerns 
but different review models from Canada’s. In the 
past the office would not have had sufficient staff 
resources to undertake this range of activities, but 
the hiring of a director of review and government 
liaison and a director of review and military liaison 
will permit continued involvement in these 
communities in the future. 


On April 27, 2004, the government tabled in 
Parliament its first national security policy, entitled 
Securing an Open Society: Canada’s National 
Security Policy. The policy addresses a range of 
national security issues and provides guidance in 
six strategic areas: intelligence, emergency 
planning and management, public health, transport 
security, border security, and international security. 
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The policy also calls for the development of new 
structures and strategies that the government 
believes will enable it to anticipate and manage 
current and future threats to Canada’s national 
security interests. 


Among the changes in government structure 
announced on December 12, 2003, and confirmed 
in the national security policy announcement, 

was a proposal to establish a new committee of 
parliamentarians whose members would be sworn 
in as Privy Councillors so they could be briefed on 
national security issues. 


These initiatives obviously have the potential to 
influence the activities of my office, but it is too 
early to say what the shape or extent of this 
influence might be. My staff and I will be followin 
developments closely with a view to providing 
input where appropriate. 


Two legislative proposals before Parliament at the 
end of this reporting year may have additional 
implications for my office: 


e Passage of Bill C-7 (formerly Bill C-17), the Publ 
Safety Act, 2002, would entail new responsibilitie: 
for the Commissioner. The bill amends the 
National Defence Act to confer significant new 
responsibilities on the Commissioner of CSE for 
reviewing the lawfulness of activities undertaken 
by the Department of National Defence and the 
Canadian Forces to maintain and protect their 
computer systems and networks and for dealing 
with complaints arising from such activities.® 


ON 


Bill C-7, An Act to amend certain Acts of Canada, and to enact measures 
for implementing the Biological and Toxin Weapons Convention, in orde 
enhance public safety, 3rd Sess., 37th Parl., 2004; Bill C-17, An Act to 
amend certain Acts of Canada, and to enact measures for implementing t 
Biological and Toxin Weapons Convention, in order to enhance public 
safety, 2nd Sess., 37th Parl., 2002. 


¢ Bill C-14 (formerly Bill C-32) amends provisions 
of the Criminal Code and the Financial 
Administration Act, among other acts. It 
introduces new provisions, including a new 
authority to intercept private communications for 
the purpose of managing and protecting computer 
systems and networks. There is a question of how 
this bill will affect the provisions and passage of 
the proposed Public Safety Act, 2002, which has 
similar wording. ’ 


My concerns are threefold: 


¢ the fact that passage of both bills would establish 
different governing authorities dealing with 
essentially similar activities; 


¢ the fact that passage of Bill C-7 would impose on 
the Department of National Defence a different 
accountability regime than would be imposed on 
other departments by passage of Bill C-14; and 


¢ the difficulties I am likely to encounter in 
providing meaningful assurance of lawfulness 
and compliance with ministerial authority as 
envisaged in Bill C-7. 


Developments in two other areas may also have 
implications for my office: 


¢ Parliament’s statutory review of the Anti- 
Terrorism Act three years after its initial passage 
into law is slated to begin by the end of 2004. I 
intend to provide my comments based on my 
observations to date. 


e The government introduced Bill C-25, the 
so-called whistle-blower legislation, on 


7 Bill C-14, An Act to amend the Criminal Code and other Acts, 3rd Sess., 
37th Parl., 2004; Bill C-32, An Act to amend the Criminal Code and other 
Acts, 2nd Sess., 37th Parl., 2003. 
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March 22, 2004.8 Although CSE would be 
exempt from this legislation, it would have to 
establish a system to serve essentially the same 
purpose, raising questions about a possible role 
for the Commissioner. 


We will be following these and other developments 
closely to determine their likely impact on this 
office, as well as where and how we can contribute 
our input most effectively. 


The next International Intelligence Review 
Agencies Conference will be held in Washington, 
D.C., in October 2004. Representatives of review 
agencies from Australia, Canada, New Zealand, 
the United States, the United Kingdom and other 
countries will meet to exchange views on issues of 
common interest. I look forward to receiving this 
year’s agenda. 


Looking back over the year, I would like to thank my 
predecessor as Commissioner, the Honourable 
Claude Bisson, O.C., who laid a strong foundation 
for the Office of the CSE Commissioner and from 
whom I inherited a superb staff and an organization 
well positioned to meet the challenges ahead. Thank: 
to this legacy, the transition between our tenures was 
smooth, and I was able to assume my responsibilities 
quickly and efficiently. 


Based on my experience over the past nine months, 
I believe that my mandate and resources as 
Commissioner are adequate to discharge my 
legislated duties. I look forward to continuing 

the productive relationship established with the 
Minister, with CSE and with other government 
officials as we fulfil our respective roles in 
Canada’s security and intelligence community. 


8 An Act to establish a procedure for the disclosure of wrongdoings in the 


public sector, including the protection of persons who disclose the 
wrongdoings. Its short title would be the Public Servants Disclosure 
Protection Act, 3rd Sess., 37th Parl., 2004. 
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| 
Mandate of the Communications Security Establishment 


Commissioner 
National Defence Act — Part V1 


“273.63 (1) The Governor in Council may appoint a supernumerary judge or a 
retired judge of a superior court as Commissioner of the Communications 
Security Establishment to hold office, during good behaviour, for a term of not 
more than five years. 


(2) The duties of the Commissioner are 


(a) to review the activities of the Establishment to ensure that they are in 
compliance with the law: 


(b) in response to a complaint, to undertake any investigation that the 
Commissioner considers necessary; and 


(c) to inform the Minister and the Attorney General of Canada of any activity 
of the Establishment that the Commissioner believes may not be in compliance 
with the law. 


(3) The Commissioner shall, within 90 days after the end of each fiscal year, 
submit an annual report to the Minister on the Commissioner’s activities and 
… findings, and the Minister shall cause a copy of the report to be laid before each 
House of Parliament on any of the first 15 days on which that House is sitting 
… after the Minister receives the report. 


(4) In carrying out his or her duties, the Commissioner has all the powers of a 
commissioner under Part II of the Inquiries Act. 


(5) The Commissioner may engage the services of such legal counsel, technical 
advisers and assistants as the Commissioner considers necessary for the proper 
performance of his or her duties and, with the approval of the Treasury Board, 
may fix and pay their remuneration and expenses. 


(6) The Commissioner shall carry out such duties and functions as are assigned 
~ to the Commissioner by this Part or any other Act of Parliament, and may carry 
out or engage in such other related assignments or activities as may be authorized 
by the Governor in Council. 


(7) The Commissioner of the Communications Security Establishment holding 
office immediately before the coming into force of this section shall continue in 
office for the remainder of the term for which he or she was appointed. 
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“273.65 (8) The Commissioner of the Communications Security Establishment 
shall review activities carried out under an authorization issued under this section 
to ensure that they are authorized and report annually to the Minister on the 
review.” 


Security of Information Act 


“15. (1) No person is guilty of an offence under section 13 or 14 if the 
person establishes that he or she acted in the public interest. 


“15. (5) A judge or court may decide whether the public interest in the 
disclosure outweighs the public interest in non-disclosure only if the person has 
complied with the following: 


“15. (5) (b) the person has, if he or she has not received a response from the 
deputy head or the Deputy Attorney General of Canada, as the case may be, 
within a reasonable time, brought his or her concern to, and provided all relevant 
information in the person’s possession to, 


(ii) the Communications Security Establishment Commissioner, if the person’: 
concern relates to an alleged offence that has been, is being or is about to be 
committed by a member of the Communications Security Establishment, in 
the purported performance of that person’s duties and functions of service for, 
or on behalf of, the Communications Security Establishment, and he or she 
has not received a response from the Communications Security Establishment 
Commissioner within a reasonable time”? 
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Statement of Expenditures 2003-2004 


Standard Object Summary 


Salaries and Wages 

Transportation and Telecommunications 
on 

Professional and Special Services 
Rentals 

Purchased Repair and Maintenance 


Materials and Supplies 


Acquisition of Machinery and Equipment 


| Other Expenditures 


Total 
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332005 
22027 
43,201 

246,323 

134,794 
42,019 

9,708 
51,451 
104 
$902,332 
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Classified Reports, 1996-2004 
Classified Report to the Minister — March 3, 1997 (TOP SECRET) 


Classified Report to the Minister 
— Operational Policies with Lawfulness Implications - February 6, 1998 - 
(SECRET) 


Classified Report to the Minister 
— CSE’s Activities under *** - March 5, 1998 (TOP SECRET Codeword/CEO) 


Classified Report to the Minister 
— Internal Investigations and Complaints - March 10, 1998 (SECRET) 


Classified Report to the Minister 
— CSE’s activities under *** - December 10, 1998 (TOP SECRET/CEO) 


Classified Report to the Minister 
— On controlling communications security (COMSEC) material - May 6, 1999 
(TOP SECRET) 


Classified Report to the Minister 
— How We Test (A classified report on the testing of CSE’s signals intelligence 
collection and holding practices, and an assessment of the organization’s 
efforts to safeguard the privacy of Canadians) - June 14, 1999 (TOP SECRET 
Codeword/CEO) 


Classified Report to the Minister 
— A Study of the *** Collection Program - November 19, 1999 (TOP SECRET 
Codeword/CEO) 


Classified Report to the Minister 
— On *** - December 8, 1999 (TOP SECRET - COMINT) 


Classified Report to the Minister 
— A Study of the *** Reporting Process - an overview (Phase I) - 
December 8, 1999 (SECRET/CEO) 


Classified Report to the Minister 


— A Study of Selection and *** - an overview - May 10, 2000 
(TOP SECRET/CEO) 
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Classified Report to the Minister 
— CSE’s Operational Support Activities Under *** - follow-up - May 10, 2000 
(TOP SECRET/CEO) 


Classified Report to the Minister 
— Internal Investigations and Complaints - follow-up - May 10, 2000 (SECRET) 


Classified Report to the Minister 
— On findings of an external review of CSE’s ITS Program - June 15, 2000 
(SECRET) 


Classified Report to the Minister 
— CSE’s Policy System Review - September 14, 2000 (TOP SECRET/CEO) 


Classified Report to the Minister 
— A study of the *** Reporting Process - Phase II *** - April 6, 2001 
(SECRET/CEO) 


Classified Report to the Minister 
— A study of the *** Reporting Process - Phase III *** - April 6, 2001 
(SECRET/CEO) 


Classified Report to the Minister 
— CSE’s participation *** - August 20, 2001 (TOP SECRET/CEO) 


Classified Report to the Minister 
— CSE’s support to *** as authorized by *** and *** - August 20, 2001 
(TOP SECRET/CEO) 


Classified Report to the Minister 
— À study of the formal agreements in place between CSE and various external 
parties in respect of CSE’s Information Technology Security (ITS) - 
August 21, 2002 (SECRET) 


Classified Report to the Minister 
— CSE’s support to XXX, as authorized by *** and code named *** - 
November 13, 2002 (TOP SECRET/CEO) 


Classified Report to the Minister 


— CSE’s SIGINT activities carried out under the *** 2002 *** ministerial 
authorization November 27, 2002 (TOP SECRET/CEO) 
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Classified Report to the Minister 
— Lexicon - 26 March 2003 (TOP SECRET/COMINT) 


Classified Report to the Minister 


— CSE’s activities pursuant to three XXX ministerial authorizations including 
PO EM IAYy 20; 2003 (SECRET) 


Classified Report to the Minister 
— CSE’s support to XXX, as authorized by *** and code named *** - Part I - 
November 6, 2003 (TOP SECRET/COMINT/CEO) 


Classified Report to the Minister 
— CSE’s support to XXX, as authorized by *** and code named *** - Part II - 
March 15, 2004 (TOP SECRET/COMINT/CEO) 


Classified Report to the Minister 


— A review of CSE’s activities conducted under XXX ministerial authorization - 
March 19, 2004 (SECRET/CEO) 


Classified Report to the Minister 


— Internal investigations and complaints - Follow-up - March 25, 2004 
(TOP SECRET/CEO) 
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Pursuant to subsection 273.63 (3) of the National Defence Act, | am pleased 
> submit to you my 2004-2005 annual report on my activities and findings, for your submission 


o Parliament. 
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INTRODUCTION 


SET EI ELI ITE TREES SEATS SESE IE 


In the two years since my appointment as the 
Communications Security Establishment (CSE) 
Commissioner, an array of dramatic events has 
captured the world’s attention, including the Cedar 
Revolution in Lebanon, and calls for the withdrawal 
of Syrian forces from that country, the Orange 
Revolution in the Ukraine, a renewed interest in 
the peace plan for Palestine, an election in Iraq, 
and parliamentary debates on equal rights for 
women in Kuwait. Meanwhile, Canada continues 
to deploy forces in Afghanistan so as to provide 

a secure environment suitable for the peaceful 
economic and political development of that nation. 
The positive scope of these political events 

is heartening. 


Paralleling these changes in the geo-political 
landscape is the continued threat of terrorism 
globally. As evidenced by the bombings that killed 
or injured thousands in Madrid on March 11, 2004, 
international networks of terrorists continue to 
operate. This is the global environment in which 
CSE operates, one that is uncertain and volatile. 
At the same time, we are witnessing dramatic 
technological advances that, in the wrong hands, 
pose an ongoing threat to government information 
systems and assets, and ultimately, to Canada’s 
security and economic competitiveness. 


In the face of challenges such as these, CSE plays 
an essential role and makes a vital contribution to 
Canada’s security and national interests. An integral 
part of Canada’s security and intelligence 
community, CSE provides foreign intelligence 

to the Government of Canada and ensures the 
protection of the Government’s electronic 
information and its information infrastructures. 
Today’s national security realities make it 
imperative that CSE maintain its capacity and a 
high state of technological and operational 
readiness to meet Canada’s evolving needs in 
these areas. 
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THE YEAR IN 
REVIEW 


ANNUAL REPORT 2004-2005 


As the CSE Commissioner, my role is to 
determine if CSE’s activities comply with the 
laws of Canada in general and, in particular, to 
assess whether CSE appropriately safeguards the 
privacy of Canadians. Over the past two years as 
Commissioner, I have gained an appreciation for 
the complex and important issues involved. 
Moreover, I can rely on the extensive expertise, 
loyalty and commitment of my staff to assist me 
in carrying out the Commissioner’s review role 
effectively and efficiently. 


I am pleased to submit this Annual Report for 
2004-2005, summarizing the work of my office 
over the past year. As this report demonstrates, 
much has been accomplished during that time. 
More importantly, the report provides clear suppo: 
for the essential role of the Commissioner’s reviev 
function and the assurances it brings to Canadians 


Largely as a result of the three-year review of 

Bill C-36, the omnibus Anti-Terrorism Act, there 
has been heightened attention over the past year 
to Canada’s security and intelligence community, 
including CSE. When the Bill was enacted in 
December 2001, it resulted in key amendments 

to existing Acts. Of particular interest to my office 
were the amendments to the Official Secrets Act 
(now the Security of Information Act) and the 
National Defence Act (NDA). The latter provided 
the legislative basis for CSE and this Office. Since 
December 2004, this omnibus legislation has been 
the subject of a required three-year review by 
committees of the House of Commons and the 
Senate. I will be watching the outcome of this 
review with keen interest. 


TE Le I DT I EL NTI SN TIO SN SERINE ERE I ETTORE IESE OER 


A number of other activities initiated during 
2004-2005 have the potential to significantly 
affect either my office or the broader security 
environment in which we operate. For example, 
last year saw a commitment by the Prime Minister 
to create a National Security Committee of 
Parliamentarians. This commitment was made in 
response to a proposal set out in Canada’s first-ever 
national security policy, which was tabled in 
Parliament on April 27, 2004. In this regard, an 
Interim Committee of Parliamentarians was struck 
to examine the proposal. I appeared before this 
committee on September 8, 2004. 


Of interest to my office as well are the 
deliberations and outcomes of the Commission of 
Inquiry into the Actions of Canadian Officials in 
Relation to Maher Arar, chaired by Mr. Justice 
Dennis O’Connor. In addition to investigating the 
role of Canadian officials in Mr. Arar’s deportation 
from the United States to Syria, the Commission 
is examining options for review mechanisms for 
certain activities of the RCMP. I responded to 

the opportunity to make a submission to the 
Commission about some of the review options put 
forward. In my submission, I identified the relative 
strengths and weaknesses of each approach and 
made a recommendation on how best to proceed, 
given the need to safeguard the rights of persons 
in Canada, the realities of today’s security 
environment and the highly sensitive nature of 

the RCMP’s activities. 


In my opinion, the most effective and logical 
approach is to establish one review mechanism 

to examine activities of the RCMP. This model 
would recognize the unique mandate of the RCMP, 
provide for a corresponding review body with the 
required expertise, and limit the changes required 
to the two organizations directly affected, the 
RCMP and the existing Public Complaints 
Commission. Furthermore, implementing this 
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structure would not affect other organizations or 
review groups in Canada’s security and intelligenc 
community where change in my respectful view is 
neither sought after nor required. 


That being said, the Arar Commission’s goal will 
be to strike an appropriate balance that is in the be 
interests of Canada. Again, I will be watching the 
deliberations with interest. 


I had expressed concerns in last year’s annual 
report about two legislative proposals: Bill C-7, 
the Public Safety Act, 2002, which introduced 
legislative amendments on a range of subjects, 
from transportation safety and immigration to 
biological weapons; and Bill C-14, which 
proposed amendments to the Criminal Code and 
the Financial Administration Act, among others. 
The concerns I had initially expressed about this 
legislation were later addressed. I am satisfied that 
as passed, the legislation establishes uniform 
responsibility and accountability for all 
departments for the protection of their computer 
systems and networks. 


Bill C-11, the so-called whistle-blower legislation, 
was first introduced as Bill C-25 on March 22, 
2004, but to date has not been passed by 
Parliament. Although CSE is exempt from such 
legislation, passage of the Bill would place an 
onus on CSE to establish a parallel system, with a 
possible review role for the Commissioner. 
Obviously, this legislation is of interest to me 

and I will continue to monitor its progress in 
Parliament, as well as any response by CSE. 
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200 4-200 5 Each year, my office undertakes extensive reviews 
of CSE activities in areas that were identified as 
ACTIVITI ES priorities as part of a multi-year workplan. Most 
often, these are areas within the intelligence 
production cycle where there is the potential for 
privacy issues to be raised. I report to the Minister 
of National Defence on all my reviews, either to 
provide assurance of the lawfulness of CSE 
activities or to bring his attention to specific 
concerns that arise as a result of the reviews. 
| My activity as Commissioner properly remains 
confined to ex post review, and not to oversight, 
which entails a role in relation to CSE’s ongoing 
activities. 


cut a nee vo ——  — - mr: 


During 2004-2005, I submitted a total of five 
classified reports to the Minister — two under my 
general review mandate and the remainder in 
compliance with my mandate to review specific 
activities authorized by the Minister. 


The review process As in all my work, I place a high priority on 

| collaboration during the review process. In 
practice, this means sharing any concerns with 

| relevant personnel in CSE at the earliest possible 
| stage so that appropriate corrective action can be 

| taken, if required. As part of my office’s efforts to 
| effect change in a timely way, my staff now 
provide a summary briefing to all concerned 

CSE personnel following the review process. 


One of the underlying principles guiding review 

is the anticipation of problem areas before they 

| arise. That means looking beyond the issue of 

| whether an unlawful activity has occurred, to 
whether one might occur and what measures can 
be put in place to prevent it. I believe this type of 
proactive and preventive approach is essential in 
balancing the undisputable need for security and 
intelligence activities with the fundamental privacy 
rights we have come to expect in Canada. 
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Reviews under the 
Commissioner’s 
general mandate 


In the period covered by this report, I submitted 
two classified reports to the Minister of National 
Defence on subjects related to my general mandate 
to review CSE’s activities to ensure they conform 
with the law. 


One of the reports involved a review of an 
operational program conducted by CSE under the 
authority of subsection 273.64(1)(a) of the NDA, 
often referred to as CSE’s foreign intelligence 
mandate. In this instance, my findings indicated 
that CSE had acted lawfully in respect of this 
program. Moreover, employees assigned to this 
program demonstrated knowledge and awareness 
of the relevant law and policy that governed it. 


The other classified report to the Minister 
concerned my review of a subset of activities 
conducted by CSE under the authority of 
subsection 273.64(1)(c) of the NDA, in response to 
requests for assistance received from federal law 
enforcement agencies.? In this regard, the RCMP is 
CSE’s primary client. When providing assistance 
to the RCMP, the scope of which is limited and 
defined in policy, CSE does so as an agent. Before 
agreeing to act in that capacity, however, CSE must 
first satisfy itself that the RCMP is authorized to 
make the request and then be satisfied that it has 
the authority to provide the assistance the RCMP 
has requested. 


My office examined CSE’s assistance to the RCMP 
under mandate (c) for the year 2003. Based on the 
activities reviewed, CSE’s assistance was found to 
be in compliance with the law. 


1 See Annex A. 

2 273.64(1) The mandate of the Communications Security Establishment is: 
(c) to provide technical and operational assistance to federal law 
enforcement and security agencies in the performance of their 
lawful duties. 
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That being said, however, both reports included 
recommendations, many of which concerned 
certain weaknesses in CSE’s policies and 
procedures, an area that has drawn similar 
attention and mention in previous reviews. I have 
also recommended that CSE accelerate efforts to 
improve and update existing information and 
records management systems. At the time of 
writing, CSE had resolved some of these issues 
and had committed to address the remainder in 
the coming months. 


Reviews of As stated, it is my practice to conduct ex post 
TT review. In the case of CSE’s MA-related activities, 
activities under my reviews are undertaken once the authorizations 
ministerial in question expire. 
authorization (MA) 
My focus for the year under review was on 
activities conducted by CSE under the authority 
of three MAs, all of which concerned foreign 
intelligence collection and were the subject of 
classified reports to the Minister. 


In conducting review activities for MAs, my office 
is guided directly by the legislation, which dictates 
what activities CSE can and cannot undertake. 
Specifically, my reviews in this area focus on the 
interception of private communications, which is 
what an MA authorizes. A private communication 
is defined in section 183 of the Criminal Code as 


... any oral communication, or any 
telecommunication, that is made by an 
originator who is in Canada or 1s 
intended by the originator to be received 
by a person who is in Canada and that is 
made under circumstances in which it is 
reasonable for the originator to expect 
that it will not be intercepted by any 
person other than the person intended 
by the originator to receive it, and 
includes any radio-based telephone 
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communication that is treated 
electronically or otherwise for the 
purpose of preventing intelligible 
reception by any person other than the 
person intended by the originator to 
receive itis. 


For the purpose of foreign intelligence collection, 
the NDA authorizes CSE to intercept private 
communications as long as the interception was the 
result of its having directed activities at a foreign 
entity located outside Canada. Over the past two 
years, I have focused much of my attention on 
foreign intelligence MAs because of their broad 
scope and potential degree of intrusiveness on 

the privacy of Canadians. While information 
technology security (ITS) MAs also authorize the 
interception of private communications, CSE seeks 
such authority in every instance at the request of the 
client agency whose systems and networks are 
being verified. 


In my last annual report, I observed that a number 
of my concerns had been resolved, while some 
others remained. During this past year, I have 
been able to bring clarity to points of law and 
interpretation with respect to CSE’s activities 
conducted under the authority of these provisions. 
My office engaged in discussions with staff and 
officials at CSE throughout this process. 


For jurists who are accustomed to dealing with 
warrants issued by judges, a foreign intelligence 
MA is a Strange sort of creature. However, one 
must take into account that, when collecting foreigr 
intelligence, CSE is directing its interception efforts 
at foreign communications, or at least at the foreign 
end of communications, and a warrant issued by a 
Canadian court has no jurisdiction outside Canada 
in this instance. 
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Foreign intelligence MAs are a unique solution to 
an equally unique set of circumstances that can 
arise when CSE recognizes that an intercepted 
communication either leads into or flows out of 
Canada. While the interception has not been 
directed at a communication in Canada, one 

end of the communication is in Canada and is 
therefore, by law, a private communication. Xf 
this communication contains information essential 
to international affairs, defence or security, as 
specified in CSE’s legislation, it is reasonable that 
the Government of Canada would want CSE 

to retain and report on it. 


The foreign intelligence MA provisions in Part V.1 
of the NDA include four conditions that must be 
met before the Minister of National Defence 
will authorize the interception of a private 
communication. I am of the opinion that their 
inclusion is both reasonable and consistent with 
other legislation that establishes an authority to 
engage in activities that would, in the absence of 
adequate justification, be judged an infringement 
on the rights of individuals as protected by the 
Charter of Rights and Freedoms. 


In my view, these MA provisions are an exception 
to Part VI of the Criminal Code that protects 
against the invasion of privacy. I have no doubt 

as to their purpose because the NDA explicitly 
authorizes the interception of private 
communications subject to the threshold 
established by the four conditions, and to 
ministerial review. From my examination of private 
communications intercepted by CSE, I am able to 
determine if CSE has met the conditions imposed 
in the MA — for example, I know if the interception 
was a result of activities directed at a foreign entity 
outside of Canada. I can also determine if the 
communication was lawfully used, retained or 
destroyed — that is to say, whether or not it was 
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Review of past 
recommendations 


10 
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essential to the international affairs, defence or 
security of Canada. 


In light of the above, I believe my review of 
activities that CSE has conducted under a foreign 
intelligence MA must focus on the intercepted 
private communications that CSE identifies to me 
as having been recognized and retained during the 
term of the authorization. 


The Minister of National Defence is aware of how 

I have interpreted and will continue to discharge my 
mandate in respect of foreign intelligence MAs. 

I have also provided the Minister with my 
interpretation of the MA provisions, as currently 
written, and what they allow for in law. Further, I 
have made specific suggestions as to what could be 
done to remove ambiguities and to ensure a 
common understanding of the operational 
application of these provisions. 


There is substantial evidence that I believe supports 
my office’s review function and the impact it has 
ad on CSE’s internal processes over the years. 
When warranted by the review findings, I may 
include recommendations for action on the part of 
CSE. My recommendations are, appropriately, non- 
binding. Binding recommendations would usurp the 
prerogative of both the Minister, who has overall 
responsibility for CSE, and of the Chief of CSE, 
who is responsible under Part V.1 of the NDA for 
the management and control of the organization. 
However, one of the concerns with a review body 
whose recommendations are non-binding is 
whether that review is effective or not. I can say 
with confidence that review works, based on my 
experience with CSE’s response to the 
recommendations made by my office. 


As I outlined in my previous annual report, last 
year we began a process to track CSE’s response to 
the recommendations my predecessor and I made in 
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2004-2005 findings 


classified reports submitted to the Minister of 
National Defence since 1996. I am pleased to 
provide an update. A process has also been 
put in place to ensure a timely response to 
recommendations made in upcoming reports 
from my office. 


Over the past year, my staff worked closely with 
CSE to monitor their response and subsequent 
actions with respect to the recommendations — 
including establishing timetables and target dates 
for completion. Of the 77 recommendations made 
from 1996 to the end of the current fiscal year, the 
majority have been accepted and implemented, 
and I am awaiting what I believe will be a positive 
response from CSE on a number of others. Many 
of the recommendations address broad policy 
issues such as formalizing relations, while others 
focus on technical and operational practices, 
including ensuring consistent definitions and 
appropriate accountability structures. That being 
said, the ultimate goal of all recommendations | 
make is to prevent conditions or practices that have 
the potential to lead to unlawfulness or that could 
affect the privacy of Canadians. I believe that 

this tracking process for recommendations 1s 
fundamental to achieving this goal. 


I commend the Chief of CSE on the extent to 
which he has accepted review as an integral part 
of the vision for his organization. As well, I would 
like to express my appreciation to CSE for their 
co-operation and willingness to monitor the 
recommendations. 


Each year, I state my findings about the lawfulness 
of CSE’s activities based on the reviews my office 
has conducted over the past year. I am able to 
report that I am satisfied that the CSE activities 
examined during the period under review complied 
with the law. Moreover, I am satisfied that the 
intercepted private communications I examined 
were lawfully acquired, used and retained. 
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Complaints and Under Paragraph 273.63 (2)(b) of the National 
concerns about Defence Act, lam required to respond toa 
CSE Activities complaint by undertaking any investigation I 

consider necessary to determine whether CSE is 
engaging in unlawful activity. At various fora, 
people have expressed their surprise at the limited 
number of complaints directed toward my office 
over the years. 


To my mind, the likelihood of a public complaint 
is diminished by the nature and focus of CSE’s 
activities, which are technology-based and directed 
at foreign entities outside Canada. Unlike other 
federal intelligence or law enforcement agencies, 
CSE neither has a public profile nor engages in 
activities that place it in the public domain. During 
2004-2005, I received no complaints about CSE 
activities from any source. 


THE The reviews that my office conducts are in-depth 
: and multi-faceted, taking months to complete. 
COMMISSIONER S I place great importance on ensuring that they are 
OFFICE carried out with methodological rigour and 
consistency. Last year, I requested an internal 
study of my office’s own review processes and 
I am satisfied that it employs the full range of 
appropriate analytical and investigative review 
methodologies that are best practices in the public 
and private sectors. Briefings, multi-level 
interviews, the examination of a broad range of 
hard and soft copy records holdings, (including 
authorities, policies, legal opinions and operational 
files), legal research, inter-agency consultation and 
debriefing sessions are just some of the elements 
that constitute this process. 


During the past year, my staff also upgraded its 
electronic record-keeping system, known as 
RDIMS (records/document information 
management system). It is designed to improve 
the security, retention and access to both 
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non-electronic and electronic documents. This has 
enhanced my office’s ability to track and manage 
its internal records. 


In support of the review function, my office 
maintains a full-time working staff of eight, as well 
as a complement of contract professionals who 
bring a range of expertise and experience in a 
variety of related fields. For example, some of my 
staff have had considerable exposure to Canada’s 
security and intelligence community; others have 
special expertise in information technology, 
research, policy development and communications. 
As a result of a multi-phase staffing initiative that 
was completed in June 2004, my office has been 
operating at full strength for almost a year. I do 

not anticipate further staffing requirements in 

the near future, provided the tempo of activity 
remains unchanged. 


To ensure that my staff stays connected to and 
engaged in the broader issues facing the security 
and intelligence community, we host informal 
presentations by representatives of government and 
academia working in the security field. Last year, 
on five occasions, we invited presenters to speak 
about, and share in discussions on, Canadian 
intelligence priorities in such subject areas as 
terrorism, information technology and the law, 

and privacy. 


As part of my efforts to ensure awareness of the 
role of the Commissioner, last year my staff — at 
CSE’s invitation — began to give presentations to 
new CSE employees as part of their orientation 
course. This contributes directly to CSE’s 
fulfillment of the Ministerial Directive on 
Accountability Framework, which is designed to 
ensure that CSE personnel are aware of the 
Commissioner’s mandates of determining whether 
those activities (of CSE) are in compliance with the 
law and of investigating complaints by citizens, 
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including CSE employees, or permanent residents 
of Canada concerning the lawfulness of such 
activities. The Chief of CSE is also directed to 
ensure CSE employees extend full support and 
cooperation to the Commissioner in carrying out 
his mandate. 


In the interests of sharing expertise and learning 
about timely issues, my staff attended two 
conferences in October 2004: the International 
Intelligence Review Agencies Conference (IIRAC) 
in Washington D.C., and the annual Canadian 
Association for Security Intelligence Studies 
(CASIS) in Ottawa. In March 2005, I was invited 
to participate in a symposium on Counter-terrorism 
and the Law held at the University of Ottawa. 
While I declined to be a member of the panel, 

I took the opportunity offered me to address the 
participants, and I offered a few thoughts for their 
consideration. In addition, and for the second year, 
one of my staff will participate in the National 
Security Studies Seminar organized by the 
Canadian Forces College and planned for April. 
These events allow for the exchange of ideas 

and information on issues of mutual interest 

and concern, and help to keep us abreast of 
developments in the world that affect intelligence 
and review. 


During the past year, my office’s annual 
expenditures were $966,781. I am able to report 
that, once again, I discharged my mandated 
activities within budget. Annex B to this report 
provides a statement of my office’s expenditures. 


SHAPI NG THE It goes without saying that Canada’s security and 


intelligence sector — as well as its various review 
REVIEW mechanisms — will be shaped by the important 


ENVIR O NM ENT parliamentary and government initiatives currently 
underway. As discussed earlier in this report, 
the ongoing three-year review of the omnibus 
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CONCLUDING 
THOUGHTS 


Anti-Terrorism Act, the recommendations on 
review mechanisms for the RCMP that are 
anticipated from the Arar Commission and the 
proposed National Security Committee of 
Parliamentarians, all have the potential to make a 
substantial impact on the security and intelligence 
sector over the coming months and years. 


As CSE Commissioner, I will continue to monitor 
these initiatives carefully and, wherever possible, 
make a positive contribution to the outcomes. I 
believe that the review community has much to 
offer and I welcome the opportunity to be part of 
the process. One of the principles guiding my input 
will be the need for a thoughtful approach to these 
issues, one that does not attempt to change what 
works, merely for the sake of change itself. While 
changes may certainly be called for, we must take 
care not to dilute what Parliament has put in place 
without due consideration and reflection. 


Despite the fact that the past year has posed many 
challenges, I look back upon it with no small 
degree of satisfaction. It has been a successful year. 
Addressing certain ambiguities in law in respect of 
CSEF’s activities under Ministerial authorizations, 
and establishing how my office will increase its 
effectiveness in reviewing them, for example, are 
positive steps. I am heartened by the number of 
recommendations made since the creation of my 
office that CSE has accepted and implemented, 
and by the ongoing dialogue between CSE 

and ourselves. 


On a broader note, I am fully persuaded that review 
agencies such as my own can make an important 
contribution to the ongoing debate between the 
considerations of security and of privacy. Western 
democracies must make difficult choices as to 
where to draw the line at a time when asymmetric 
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threats are a part of our reality, and it is not an 
easy debate. 


At a recent symposium on Counter-terrorism and 
the Law held at the University of Ottawa, and 
referred to earlier, my former colleague Supreme 
Court Justice Ian Binnie raised questions for 
discussion by the panel. He observed that the 
greatest threat to our rule of law is terrorism, and 
in matters of security it is absolutely necessary 

for the courts to show deference to state agencies 
because they have more expertise, information and 
resources on such matters than the courts. He 
questioned, however, at what point this deference 
should stop. While I do not have an easy answer to 
Mr. Justice Binnie’s question, I know that it is one 
that merits serious contemplation given the 
challenges our contemporary society faces. 
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Mandate of the Communications Security Establishment 
Sommissioner 


Vational Defence Act — Part V1 


“273.63 (1) The Governor in Council may appoint a supernumerary judge or a 
| retired judge of a superior court as Commissioner of the Communications 
Security Establishment to hold office, during good behaviour, for a term of not 
more than five years. 


(2) The duties of the Commissioner are 


(a) to review the activities of the Establishment to ensure that they are in 
compliance with the law; 


(b) in response to a complaint, to undertake any investigation that the 
Commissioner considers necessary; and 


(c) to inform the Minister and the Attorney General of Canada of any activity 
of the Establishment that the Commissioner believes may not be in compliance 
with the law. 


(3) The Commissioner shall, within 90 days after the end of each fiscal year, 
submit an annual report to the Minister on the Commissioner’s activities and 
findings, and the Minister shall cause a copy of the report to be laid before each 
House of Parliament on any of the first 15 days on which that House is sitting 
after the Minister receives the report. 


(4) In carrying out his or her duties, the Commissioner has all the powers of a 
commissioner under Part II of the Inquiries Act. 


(5) The Commissioner may engage the services of such legal counsel, technical 
advisers and assistants as the Commissioner considers necessary for the proper 
performance of his or her duties and, with the approval of the Treasury Board, 
may fix and pay their remuneration and expenses. 


(6) The Commissioner shall carry out such duties and functions as are assigned 
to the Commissioner by this Part or any other Act of Parliament, and may carry 
out or engage in such other related assignments or activities as may be authorized 
by the Governor in Council. 


(7) The Commissioner of the Communications Security Establishment holding 
office immediately before the coming into force of this section shall continue in 
office for the remainder of the term for which he or she was appointed. 


ANNEX A 17 


“273.65 (8) The Commissioner of the Communications Security Establishment 
shall review activities carried out under an authorization issued under this section| 
to ensure that they are authorized and report annually to the Minister on the 
review.” 


Security of Information Act 


“15. (1) No person is guilty of an offence under section 13 or 14 if the 
person establishes that he or she acted in the public interest. 


“15. (5) A judge or court may decide whether the public interest in the | 
disclosure outweighs the public interest in non-disclosure only if the person has 
complied with the following: 


“15. (5) (b) the person has, if he or she has not received a response from the | 
deputy head or the Deputy Attorney General of Canada, as the case may be, 
within a reasonable time, brought his or her concern to, and provided all relevant © 
information in the person’s possession to, 


(11) the Communications Security Establishment Commissioner, if the person’s 
concern relates to an alleged offence that has been, is being or is about to be 
committed by a member of the Communications Security Establishment, in 

the purported performance of that person’s duties and functions of service for, 
or on behalf of, the Communications Security Establishment, and he or she | 
has not received a response from the Communications Security Establishment 


Commissioner within a reasonable time.” | 
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statement of Expenditures 2004-2005 
tandard Object Summary 


salaries and Wages 
Transportation and Telecommunications 
information 


Professional and Special Services 


Purchased Repair and Maintenance 


‘Materials and Supplies 


Acquisition of Machinery and Equipment 


ee 


Other Expenditures 


ANNEX B 


514,130 
20,688 
13205 

216,889 

142,454 

105 
8,581 
45,464 
Jeu 
$966,781 
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Classified Reports, 1996-2005 


Classified Report to the Minister 
— March 3, 1997 (TOP SECRET) 


Classified Report to the Minister 
— Operational Policies with Lawfulness Implications — February 6, 1998 — 
(SECRET) 


Classified Report to the Minister 
_ CSE’s Activities under *** — March 5, 1998 (TOP SECRET Codeword/CEO) 


Classified Report to the Minister 
_ Internal Investigations and Complaints — March 10, 1998 (SECRET) 


Classified Report to the Minister 
_ CSE’s activities under *** — December 10, 1998 (TOP SECRET/CEO) 


Classified Report to the Minister 
— On controlling communications security (COMSEC) material — May 6, 1999 
(TOP SECRET) 


Classified Report to the Minister 
_ How We Test (A classified report on the testing of CSE’s signals intelligence 
collection and holding practices, and an assessment of the organization’s efforts 
to safeguard the privacy of Canadians) — June 14, 1999 (TOP SECRET 
Codeword/CEO) 


Classified Report to the Minister 
— A Study of the *** Collection Program — November 19, 1999 (TOP SECRET 
Codeword/CEO) 


Classified Report to the Minister 
_ On *** — December 8, 1999 (TOP SECRET/COMINT) 


Classified Report to the Minister 
— A Study of the *** Reporting Process — an overview (Phase I) — 
December 8, 1999 (SECRET/CEO) 


Classified Report to the Minister 


— A Study of Selection and *** — an overview — May 10, 2000 
(TOP SECRET/CEO) 
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Classified Report to the Minister 
— CSE’s Operational Support Activities Under *** — follow-up — May 10, 2000 
(TOP SECRET/CEO) 


Classified Report to the Minister 
— Internal Investigations and Complaints — follow-up — May 10, 2000 (SECRET) 


Classified Report to the Minister 
— On findings of an external review of CSE’s ITS Program — June 15, 2000 
(SECRET) 


Classified Report to the Minister 
— CSE’s Policy System Review — September 14, 2000 (TOP SECRET/CEO) 


Classified Report to the Minister 
— A study of the *** Reporting Process — Phase II *** — April 6, 2001 
(SECRET/CEO) 


Classified Report to the Minister 
— A study of the *** Reporting Process — Phase III *** — April 6, 2001 
(SECRET/CEO) 


Classified Report to the Minister 
— CSE’s participation *** — August 20, 2001 (TOP SECRET/CEO) 


Classified Report to the Minister 
— CSE’s support to *** as authorized by *** and *** — August 20, 2001 
(TOP SECRET/CEO) 


Classified Report to the Minister 
— A study of the formal agreements in place between CSE and various external 
parties in respect of CSE’s Information Technology Security (ITS) — 
August 21, 2002 (SECRET) 


Classified Report to the Minister 
— CSE’s support to XXX, as authorized by *** and code named *** — 
November 13, 2002 (TOP SECRET/CEO) 


Classified Report to the Minister 


— CSE’s SIGINT activities carried out under the *** 2002 *** Ministerial 
authorization — November 27, 2002 (TOP SECRET/CEO) 
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Classified Report to the Minister 
— Lexicon — 26 March 2003 (TOP SECRET/COMINT) 


Classified Report to the Minister 
_ CSE’s activities pursuant to three XXX Ministerial authorizations including *** 
*#k% _ May 20, 2003 (SECRET) 


Classified Report to the Minister 
— CSE’s support to XXX, as authorized by *** and code named *** — Part I — 
November 6, 2003 (TOP SECRET/COMINT/CEO) 


Classified Report to the Minister 
_ CSE’s support to XXX, as authorized by *** and code named *** — Part Il — 
March 15, 2004 (TOP SECRET/COMINT/CEO) 


Classified Report to the Minister 
_ A review of CSE’s activities conducted under XXX Ministerial authorization — 
March 19, 2004 (SECRET/CEO) 


Classified Report to the Minister 
_ Internal investigations and complaints — follow-up — March 25, 2004 
(TOP SECRET/CEO) 


Classified Report to the Minister 
_ A review of CSE’s activities conducted under XXX Ministerial authorization — 
April 19, 2004 (SECRET/CEO) 


Classified Report to the Minister 
_ Review of CSE XXX Operations under Ministerial authorization — 
June 1, 2004 (TOP SECRET/COMINT) 


Classified Report to the Minister 
— CSE’s Support to XXX — January 7, 2005 (TOP SECRET/COMINT/CEO) 


Classified Report to the Minister 
_ External Review of CSE’s XXX Activities Conducted Under Ministerial 
authorization — February 28, 2005 (TOP SECRET/COMINT/CEO) 


Classified Report to the Minister 


— A Study of the XXX Collection Program — March 15, 2005 (TOP SECRET/ 
COMINT/CEO) 
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The Right Honourable Antonio Lamer, Le très honorable Antonio Lamer, 
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April 2006 


Minister of National Defence 

MGen G.R. Pearkes Building, 13th Floor 
.01 Colonel By Drive, North Tower 
Dttawa, Ontario 

<1A OK2 


Dear Sir: 


| Pursuant to subsection 273.63 (3) of the National Defence Act, I am pleased 
to submit to you my 2005-2006 annual report on my activities and findings, for your submission 


f Parliament. 


Yours sincerely, 


Antonio Lamer 


Ottawa, Canada 
K1P 5R5 
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THE 
OMMISSIONER’S 
ROLE 


Parliament passed the Anti-Terrorism Act in 
December 2001. This amended the National Defence 
Act (NDA) and established in legislation the role and 
responsibilities of the Communications Security 
Establishment (CSE) and the CSE Commissioner. 


My primary legislated duty is to review the activities 
of CSE to determine whether they comply with 

the laws of Canada. The Act charges me to review 
CSE’s activities in general and, as well, specifically 
to review activities that CSE carries out under 
ministerial authorization. Given the nature of CSE’s 
activities, I place a particular emphasis on deter- 
mining whether those activities are carried out in a 
manner that appropriately protects the privacy 

of Canadians,! as CSE is required to do by law. 


My other duties include undertaking such investiga- 
tions as I consider necessary in response to any 
complaints received about CSE’s activities, and 
informing the Minister of National Defence and the 
Attorney General of Canada about any CSE activity 
that I believe may not be in compliance with the law. 


As I see it, my main role as the CSE Commissioner 
is to give assurance to the Minister of National 
Defence that the intrusive powers Parliament granted 
to CSE are used in accordance with the legislation. 
Annex A of this report sets out the key elements of 
my mandate under the National Defence Act, as well 
as my duties under the Security of Information Act. 


The Communications Security Establishment, the 
subject of my attention as Commissioner, is a central 
player in Canada’s security and intelligence 
community. CSE’s mandate under Part V.1 of the 
National Defence Act includes: 


¢ acquiring and using information from the global 
information infrastructure to provide the 


| Tt is important to note that “Canadians” includes Canadian citizens, 
permanent residents and corporations incorporated in Canada. 
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Government of Canada with foreign intelligence 
in accordance with the government’s intelligenc 
priorities; 


¢ helping to protect electronic information and 
information infrastructures that are of importance 
to the Government of Canada; and 


¢ providing technical and operational assistance tc 
federal law enforcement and security agencies ir 
the performance of their lawful duties. 


I carry out all my responsibilities in full recognitio: 
of the importance of CSE’s contribution to ensurin; 
that the Government of Canada is in a position to 
play an active, well-informed role in promoting anc 
protecting Canadian interests in a rapidly changing 
world. In light of the continuing threat of terrorism 
around the world in recent years, I am particularly 
aware of CSE’s important contribution to protectin; 
the security of Canada and Canadians. It is not my 
intention to impede CSE from fulfilling its importa 
role. Rather, I believe that CSE’s effectiveness is 
enhanced when I am able to provide evidence-base 
assurance not only about the lawfulness of its 
activities, but also about the policies, procedures 
and processes it has in place to help ensure that 
lawfulness. 


I am pleased to submit this annual report summar- 
izing my office’s activities and findings for the year 
ended 31 March 2006. In doing so, I would like to 
express my appreciation for the cooperation and 
assistance that my office received from the CSE’s 
new Chief and his staff throughout the year. 
Although it is normal, and indeed fitting, for a 
measure of healthy tension to exist in the relationsh 
between any review body and the organization bein 
reviewed, the professionalism of CSE’s employees 


2 Foreign intelligence is defined in Part V.1 of the NDA as “information 
or intelligence about the capabilities, intentions or activities of a foreign 
individual, state, organization or terrorist group, as they relate to 
international affairs, defence or security”. 
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THE REVIEW 


ENVIRONMENT 
| 


Three-year 
review of the 


Anti-Terrorism Act 


has facilitated the work of my office and made it 
more productive. 


Several developments during the year, some of them 
new and some of them continuing, have the potential 
to shape the security and intelligence sector in 
general, as well as the roles and responsibilities of 
review bodies such as my office. I have monitored 
these developments closely and seized the 
opportunity to contribute to them as appropriate. 


The omnibus Anti-Terrorism Act resulted in key 
amendments to several existing Acts, including 
amendments to the National Defence Act that 
provided the legislative basis for CSE as well as 

the CSE Commissioner. The Anti-Terrorism Act 
required a review of its provisions and operation 
within three years of receiving Royal Assent, and the 
Special Senate Committee on the Anti-Terrorism Act 
was created for this purpose in December 2004. 


I appeared before the Special Senate Committee on 
13 June 2005, as well as the House of Commons 
Sub-Committee on Public Safety and National 
Security two days later, on 15 June. On both 
occasions, I set out my views on the legislation, 
based on the experience of this office since its 
enactment. In my remarks, I made it very clear that 
the legislation itself is absolutely essential. However, 
I noted also that fine-tuning and clarification of 
some of its provisions — particularly those relating 
to ministerial authorizations to intercept private 
communications for the purpose of obtaining foreign 
intelligence? — would help eliminate ambiguities 
and ensure a common understanding of the 
operational application of these provisions. In 


3 In my 2004-2005 Annual Report, I outlined my views in some detail on how 
I have interpreted and will continue to discharge my mandate in respect of 
foreign intelligence ministerial authorizations (pp. 7-10). 
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“Whistle-blower” 
legislation 


Bills that died on 
the order paper 


ANNUAL REPORT 2005-2006 


addition to my appearances, I wrote to the Chair of 
the Sub-Committee to provide my views on certain 
recommendations made by other witnesses that 
would affect my office. 


Upon the dissolution of Parliament in November 
2005, the Special Senate Committee on the Anti- 
Terrorism Act was also dissolved without having 
issued its report. The new Parliament was not yet in 
session when my reporting period ended on 31 
March 2006, but I will monitor future developments 
in this area with keen interest. 


The Public Servants Disclosure Protection Act 

(the so-called “whistle-blower” legislation) received 
Royal Assent in November 2005. The Act establishes 
procedures for the disclosure of wrongdoings in the 
public sector and provides for the protection of 
persons who disclose the wrongdoings. Although my 
office will be subject to this Act, the Communications 
Security Establishment is excluded from the defin- 
ition of “public sector” and thus from its general 
application. However, the Act provides that excluded 
organizations, such as CSE, must establish similar 
procedures, specific to the organization concerned. 


The Act has yet to come into effect, and I understand 
that Bill C-2 (Federal Accountability Act) tabled by 
the new government may change some of the 
provisions of the “whistle-blower” legislation. 
Nevertheless, it is probable that CSE will be required 
to establish procedures for the disclosure of wrong- 
doings, including the protection of persons who 
disclose them — with a possible review role for the 
CSE Commissioner. I am quite prepared to take on 
responsibilities in this regard if called upon to do so. 


Two proposed pieces of legislation with the potential 
to influence the environment within which my office 
carries out its work died on the order paper when 
Parliament was dissolved in November 2005. As of 


EE I AT EE ET LL LR ME A I IL NB BEE AERIS EEE STEP ENE, 


the end of this reporting period, the new government 
had not yet announced whether either initiative will 
be pursued. 


Bill C-74 (Modernization of Investigative 
Techniques Act) received first reading in the House 
of Commons in November 2005. The Bill would 
require telecommunications service providers to put 
in place and maintain capabilities that facilitate the 
lawful interception of information transmitted by 
telecommunications, and to provide basic informa- 
tion about their subscribers to specified authorities. 


The proposed legislation would not affect CSE’s 
mandate in relation to foreign intelligence or its 
mandate to protect electronic information and 
information infrastructures. It could, however, 
influence the extent of the technical and operational 
assistance CSE provides to federal law enforcement 
and security agencies in the performance of their 
lawful duties. 


Bill C-81 (An Act to establish a National Security 
Committee of Parliamentarians) also received first 
reading in the House of Commons in November 
2005. The mandate of the proposed committee would 
be to review the legislative, regulatory, policy and 
administrative framework for national security, and 
the activities of federal departments and agencies 
relating to national security. It is not intended, 
however, to duplicate the work of existing review 
bodies. 


I would welcome the prospect of Parliament playing 
a more active role in security and intelligence 
matters, including scrutiny of the work of review 
bodies such as my office. However, I also recognize 
some challenges in this regard. These include, for 
example, the composition of the committee and its 
access to classified information and documents. 
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The Commission of Inquiry into the Actions of | 
Canadian Officials in Relation to Maher Arar, . 
chaired by Mr. Justice Dennis O’Connor, was 
established in February 2004. Among other things, 
the Commission is mandated to recommend a review 
mechanism for the activities of the Royal Canadian « 
Mounted Police (RCMP) with respect to their 
national security activities. In relation to this part of | 
its mandate, the Commission examined intelligence | 
review models in Canada and internationally, and | 
held public consultations. My office contributed both 


written and oral submissions. My basic message to 


the Commission was that the model already in place ! 
for reviewing Canada’s security and intelligence | 
agencies 1s a good one, and experience shows that it « 
works. 


The key characteristics of the model include separate 
review agencies, with each review agency having: 


¢ amandate aligned specifically to the functions and 
activities of the agency reviewed; 


¢ full independence; 


¢ broad, unfettered access to facilities, personnel 
and information; 


¢ authority to review all operational activities as 
well as to investigate complaints; and 


¢ the responsibility to report to the minister 
accountable to Parliament for the agency under 
review, so that accountability to Parliament is 
clear and uncompromised. 


The strengths of the model, therefore, include 
appropriateness, effectiveness and accountability. 
Moreover, the model’s flexibility means that it can 
be readily adapted to particular circumstances and 
requirements, including a mechanism uniquely 
suited to reviewing the RCMP’s national security 
activities. 


Interception 

of private 
communications 
by the U.S. 
National Security 
Agency 


I look forward with interest to the Commission’s 
report and its recommendations. 


In late 2005, the United States media reported that 
following the events of 11 September 2001, 
President George W. Bush ordered the National 
Security Agency (NSA), in the interests of national 
security, to intercept private communications of 
Americans without a court warrant. In doing so, 
according to press reports, the President bypassed 
the process established for such circumstances under 
the Foreign Intelligence Surveillance Act of 1978. 


Understandably, questions, commentary and 
speculation began to appear in the Canadian media 
about CSE’s role and activities in the current threat 
environment. As a result, I made my own extensive 
inquiries that included discussions and communi- 
cations with the Chief, CSE and drew on the 
considerable body of work carried out by my office 
in recent years. It is not my intention to comment in 
any way on the lawfulness of the NSA’s activities, 
as they are well beyond my purview. However, I 
have decided to take the opportunity afforded me by 
this Annual Report to highlight the regime in place 
in Canada. 


Part V.1 of the National Defence Act allows CSE to 
collect communications, even if they enter or exit 
Canada, provided that the target for the collection 

is a foreign entity located outside of Canada. In 
other words, the target cannot be a Canadian or 
located geographically in Canada. This kind of 
collection, where the end not targeted is in Canada, 
must be authorized by the Minister of National 
Defence in advance of the collection. The NDA sets 
out conditions that must be met to the Minister’s 
satisfaction in order for a ministerial authorization to 
be issued. It was Parliament’s view that a ministerial 
authorization, entrenched in legislation, provides a 
better approach to establishing the required authority 
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THE YEAR IN 
REVIEW 


Review activities 
and highlights 


than a court warrant, as the latter would have no 
application to foreign targets located outside Canada, 


The regime in place for CSE to acquire communi- 
cations of foreign entities, even if a communication — 
originates in or enters Canada (and is thus a private % 
communication‘), is based in legislation. Further, the’ 
NDA requires me, as the CSE Commissioner, to 
review CSE activities to ensure that they comply 

with the law. It directs me specifically to review 
activities carried out under a ministerial authori- 
zation to ensure they were authorized, and to report 4 
annually to the Minister on my review. A summary } 
of my review work completed in the year ended 

31 March 2006 follows. 


Workplan | 
A regularly updated three-year workplan guides my « 
office’s review program. This plan, which I approve, | 
is driven in part by my staff’s extensive knowledge — 
of CSE’s activities. It gives priority to reviewing 
those activities where the risks to the privacy of 
Canadians are believed highest. 


Methodology 


My staff has access to all the CSE premises, 
documents, files and personnel required to carry out © 
reviews. They conduct thorough file and document 
reviews, interview CSE officials and carry out a 
variety of checks and tests to determine whether 

CSE has carried out its activities lawfully and has 
appropriately protected the privacy of Canadians. It 

is important to note that these reviews are normally 
carried out after the fact, in order not to intervene, 
without cause, in CSE’s activities and operations 
while they are being conducted. 


4 The Criminal Code definition of a private communication includes any 
communication that originates or terminates in Canada made under 
circumstances in which it is reasonable for the originator to expect that it 
will not be intercepted by any person other than the person intended. 
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When a review is completed, I provide a classified 
report to the Minister of National Defence.> Each 
report provides the Minister with my opinion on the 
lawfulness of the activities reviewed and includes 
any recommendations that I consider to be appro- 
priate in the circumstances. Such recommendations 
generally address shortcomings in CSE’s policies, 
procedures or practices that, if not corrected, 
increase the risk that unlawful activity might occur. 
In this, as in so many other cases, I am firmly 
convinced that an ounce of prevention is worth a 
pound of cure. 


Reviews undertaken 


In 2005-2006, my office completed a total of seven 
reviews. Six reviews were of CSE activities carried 
out under ministerial authorization. One of these six 
dealt with foreign intelligence collection, and five 
involved information technology security (ITS) 
operations. I also submitted a classified report to the 
Minister on a subject related to my general mandate 
to review the activities of CSE to ensure they are in 
compliance with the law. None of my seven reviews 
of CSE activities completed in 2005—2006 reported 
unlawful conduct. 


Legal interpretations 


With respect to my reviews of CSE activities carried 
out under ministerial authorization, I note that I con- 
cluded on their lawfulness in light of the Department 
of Justice interpretation of the applicable legislative 
provisions. I have pointed out elsewhere that there 
are ambiguities in the legislation as now drafted, a 
view that I share with my predecessor, the Hon. 
Claude Bisson, O.C., a former Chief Justice of 
Quebec. Currently, two eminent lawyers, the Deputy 


5 Annex B lists all classified reports produced by the CSE Commissioner 
since 1996, when this office was established. 
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Minister of Justice and my independent Legal 

Counsel disagree over the meaning of key provisions! 
that influence the nature of the assurance that I can 4 
provide. This underlines the importance of seizing 4 
the next opportunity to make statutory amendments. 7 


Review highlights 


Findings from my recent reviews of foreign intelli- | 
gence collection under ministerial authorization have} 
drawn my attention to the process CSE uses to trans 
late approved government intelligence priorities into | 
targeting specific foreign entities. I believe it should | 
be possible to identify a clear linkage between the 4 
government intelligence priorities, the foreign 

entities targeted and the activity or class of activities 
for which ministerial authorization 1s needed. 


| 


However, reviews completed by my office, including 
the most recent one, have shown that supporting 
documentation provided by CSE as part of requests — 
for the Minister’s authorization address the 
underlying foreign intelligence requirements only i ins 
general terms. The lack of clarity in this regard has | 
made it difficult for my staff to assess compliance 
with certain of the conditions that the legislation 
requires to be satisfied before a ministerial 
authorization is given. I have offered specific 
recommendations to the Minister and CSE for 
strengthening the process. 


I provided a single integrated report to the Minister 
on the five reviews of ITS activities carried out by 
CSE under ministerial authorizations. As in previous 
reports, I set out in this report my continuing concern 
with CSE’s record-keeping practices. I recognize that 
CSE is taking steps to improve its corporate records 
management practices in general. The authority to 
intrude on the privacy of Canadians in the course of … 
protecting the government’s computer systems and 
networks under an ITS ministerial authorization is 
a sensitive matter. CSE has acknowledged its 
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responsibility to be able to record and account for 
such intrusions. I believe that CSE ought to give 
prompt attention to improving record-keeping 
practices in this regard, and I have asked my staff 
to monitor this issue closely in future reviews. 


Under my general mandate to review the activities 
of CSE to ensure they comply with the law, I 
examined CSE’s foreign intelligence collection 
activities directed at countering the threat posed 
by the proliferation of weapons of mass destruction 
and their delivery systems. Following the terrorist 
attacks in the U.S. in 2001, CSE enhanced its 
activities in the counter-proliferation area. It sends 
reports, based on the intelligence it collects and 
analyses, to Government of Canada clients and to 
allied agencies. 


In June 2005 I provided the Minister with a 
classified report setting out the findings of this 
review. The CSE activities I reviewed complied 
with the law. The review identified, however, areas 
of policy weakness and, in one instance, a need to 
reconcile policy and practice. CSE accepted my 
recommendations, though in some cases with 
modifications, which they explained to me. 


2005-2006 findings In accordance with well-established practice, in each 
Annual Report I summarize my findings about the 
lawfulness of CSE’s activities based on the reviews 
my office has completed in the past year. I am able 
to report that the CSE activities examined during the 
period under review complied with the law as it 1s 
currently interpreted by the Department of Justice, 
and I am satisfied that CSE lawfully used and 
retained the intercepted private communications that 
were examined by my office in 2005-2006. 
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Duties under 
the Security of 
Information Act 


THE IMPACT 
OF REVIEW 
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In addition to setting out my review mandate, the _ 
National Defence Act also requires me, in response | 
to a complaint, to undertake any investigation I con- | 
sider necessary to determine whether CSE engaged, © 
or is engaging in unlawful activity. Complaints may : 
be submitted by Canadians who believe that CSE 
has acted unlawfully in the performance of its duties. 
Until this past year, the Commissioner’s office 
had received no complaints that required formal 
investigation. | 
| 


There were again a limited number of complaints in 
2005-2006 and, with one exception, they were not — 
within my mandate. The one complaint received that 
both fell within my mandate and required investi- 
gation was still under investigation at the end of this | 
reporting year. I anticipate that the investigation will! 
be completed in spring 2006, after which I will 
report my findings to the Minister. 


The Security of Information Act establishes a 
process that persons permanently bound to secrecy 
under the Act must follow if they wish to claim a 
“public interest” defence for divulging classified 
information. For classified information about CSE, 
the CSE Commissioner is part of the process (see 
Annex A). No such matters were referred to me in 
2005—2006.° 


The impact of review by an office such as mine may 
be direct or indirect. Assessing that impact 1s 
inherently difficult because, if effective, its main 
influence is on preventing unlawful or undesirable 
acts or things from happening. 


Indirect impacts can result simply from the existence 
and mandate of a review body, and the effect these … 
have on how the reviewed organization conducts its — 


. . . | 

6 My website at http://csec-cest.gc.ca provides an overview of my office's | 
processes for handling complaints under the National Defence Act and for 
concerns raised pursuant to the Security of Information Act. | 

| 
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affairs. Nevertheless, my observations and discus- 
sions over the past three years make me confident 
that the mandate and work of my office has a 
positive influence on the manner in which CSE 
carries out its activities and on helping to ensure that 
they are conducted in compliance with the law. 


The findings and recommendations of specific 
reviews have a more direct impact — particularly as 
a result of the action that the reviewed organization 
takes in response to them. When warranted by the 
findings, my review reports may include recom- 
mendations for action by CSE to correct deficiencies 
in policies, procedures or practices that increase the 
risk of unlawful activity. The status of recommen- 
dations is the subject of periodic discussions 
between my staff and CSE, and my office continues 
to track their disposition. 


I am encouraged by CSE’s positive response to the 
recommendations my office has made. Of almost 
100 recommendations made by the CSE 
Commissioner since the establishment of this office, 
75 percent were accepted by CSE and have either 
been fully implemented or are at various stages of 
being implemented. Half of the remaining recom- 
mendations were accepted with some modifications 
or are very recent and are still being considered by 
CSE. The remainder were either bypassed by events 
or, in a few cases, not accepted by CSE. Where CSE 
has either accepted recommendations with 
modifications or has rejected them, CSE officials 
have explained the reasons to me, with some 
discussions still pending. 


I commend the new Chief of CSE for his ready 
acceptance of the importance of review, and 
welcome his continuing cooperation and willingness 
to help my office monitor the status of recom- 
mendations as an important indicator of the impact 
of review. 


ANNUAL REPORT 2005-2006 13 


COMMISSIONER'S 


14 


THE 


OFFICE 


In 2005-2006, my office’s expenditures of 
$1,043,540 were well within budget for the period. 
Annex C to this report provides a summary of 
2005-2006 expenditures. 


In carrying out my mandated responsibilities, I 
continue to rely on the expertise, loyalty and 
commitment of my staff. My office has a full-time 
working staff of eight people, supplemented by 
contracted professionals who bring a range of skills, 
knowledge and experience to bear as and when 
required. 


I encourage and support several activities to help 
ensure that my staff continues to sharpen skills, 


broaden knowledge and experience, and remain fully. 


engaged in the review community and in issues 


. 


| 


facing the security and intelligence sector in general. | 


Such developmental opportunities in 2005-2006 
included: 


°_initiating what has become known as the Review 
Agencies Forum. This involves my staff as well 
as the staffs of the Security Intelligence Review 


Committee, the Office of the Inspector General of. 
the Canadian Security Intelligence Service and the: 


Commission for Public Complaints Against the 
RCMP, who meet and share experiences, discuss 
issues of mutual interest and concern and identify | 
best practices in review; 


¢ continuing to host informal presentations to my 
office by government officials and academics on 
matters relating to security and intelligence as 
well as review; | 


¢ attendance of my staff at several conferences 


and symposia, including the 20 Anniversary 
International Conference of the Canadian | 
Association for Security and Intelligence Studies; | 
an International Symposium on Making National | 
Security Accountable; the National Security | 
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LOOKING TO 
THE FUTURE 


Internationally 


At home 


Studies Seminar of the Canadian Forces College; 
and the 4th Annual Charter Conference of the 
Ontario Bar Association. 


In 2004—2005, my staff began the practice of giving 
presentations to new CSE employees — as part of 
their orientation course — about the duties, powers 
and work of the CSE Commissioner. These pre- 
sentations continued in 2005-2006. I believe that 
this is an excellent way for my office to participate 
in assuring that CSE employees are aware of the 
Commissioner’s mandate as well as how this 
mandate is discharged in practice. 


Since assuming my responsibilities as the CSE 
Commissioner almost three years ago, terrorism has 
continued to be a dominant issue on the international 
political and security scene. Since my last report, the 
global war on terrorism has continued unabated. 
There have been numerous attacks around the globe, 
including the bombings in London, England in July 
2005 and the subsequent arrest of alleged terrorists. 
International concerns have also increased sharply 
over the proliferation of weapons of mass 
destruction, with a particular focus on North Korea 
and the nuclear ambitions and intentions of Iran. 


In Afghanistan, Canada accepted a lead role in 
providing security and helping to re-build the area in 
and around Kandahar. This undertaking has been 
made all the more important and dangerous with 
Osama bin Laden’s exhortation to his extremist 
followers to prepare for a protracted war with the 
West. 


In Canada, terrorism, the proliferation of weapons of 
mass destruction and military deployments are not 
our only concerns. Canada is an integral part of an 
economically interdependent world and must 
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continue both to protect and promote its national 
interests in that context. 


With no foreseeable diminution in perceived threats 
to the security of Canada and Canadians, or of the 
need to provide the Government of Canada with the 
foreign intelligence it requires to pursue and to 
protect Canada’s interests around the world, CSE’s 
role will continue to be important. By extension, I 
believe that the work of my office in reviewing 
CSE’s activities, in assessing their compliance with — 
the law, and in making recommendations to ensure 
that such compliance is based on sound policies, 
procedures and practices, has a useful role to play. 


Many government initiatives and activities do not fit. 
neatly into the artificial construct of a particular | 
fiscal year. As a result, there are several matters that 
will carry forward, and that I hope to see completed » 
or otherwise resolved early in 2006-2007. These 
include, for example, the three-year review of the 
Anti-Terrorism Act, the Bills that died on the order 
paper when the 38 Parliament was dissolved, and 
the report of the Arar Commission, as discussed 
earlier in this report. 


In terms of the work of my office, a major, two- 
phased review of CSE’s activities in support of the 
RCMP is nearing completion. My 2004—2005 
Annual Report included a general outline of the 
Phase 1 findings and recommendations. I am hopeful 
that outstanding issues arising from the Phase 2 work 
will be expeditiously resolved, and I plan to report … 
the Phase 2 findings and recommendations to the 
Minister early in 2006-2007. 


Finally, to ensure that the watcher is indeed watched, 
I have recently commissioned two independent 

management reviews of my own office. One will 
focus on administration, including the management | 
and control of financial, human and information | 
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resources. The other will deal with operations, by 
assessing whether the office carries out the 
Commissioner’s mandated responsibilities 
efficiently and effectively. The reviews will address 
those aspects of administration and operations that 
pose potential risks for this office and that are 
important to get right. As such, I expect that they 
will provide evidence-based assurance in relation to 
some matters, as well as recommendations for action 
where improvements are necessary. Both reviews are 
scheduled to be completed in summer 2006. 


My term expires on 19 June 2006. As a result, this is 
my last report as CSE Commissioner. I must say that 
I am extremely grateful for the opportunity I have 
had to serve Canada, this country that I love, in a 
capacity that has brought its challenges, but that I 
have found to be rewarding in so many different 
ways. My one regret will be if I leave this position 
without a resolution of the legal interpretation issues 
that have bedevilled this office since December 
2001. If that does indeed turn out to be the case, I 
wish my successor well in bringing this matter to a 
satisfactory conclusion for all concerned. 
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Æandate of the Communications Security Establishment 
ommissioner 


(2) 


(3) 


(4) 


(5) 


(6) 


Jational Defence Act — Part V.1 


"73.63 (1) The Governor in Council may appoint a supernumerary judge or a retired 


judge of a superior court as Commissioner of the Communications 
Security Establishment to hold office, during good behaviour, for a term 
of not more than five years. 


The duties of the Commissioner are 


(a) to review the activities of the Establishment to ensure that they are in 
compliance with the law; 


(b) in response to a complaint, to undertake any investigation that the 
Commissioner considers necessary; and 


(c) to inform the Minister and the Attorney General of Canada of any 
activity of the Establishment that the Commissioner believes may not 
be in compliance with the law. 


The Commissioner shall, within 90 days after the end of each fiscal year, 
submit an annual report to the Minister on the Commissioner’s activities 
and findings, and the Minister shall cause a copy of the report to be laid 
before each House of Parliament on any of the first 15 days on which that 
House is sitting after the Minister receives the report. 


In carrying out his or her duties, the Commissioner has all the powers of a 
commissioner under Part II of the Inquiries Act. 


The Commissioner may engage the services of such legal counsel, 
technical advisers and assistants as the Commissioner considers necessary 
for the proper performance of his or her duties and, with the approval of 
the Treasury Board, may fix and pay their remuneration and expenses. 


The Commissioner shall carry out such duties and functions as are 
assigned to the Commissioner by this Part or any other Act of Parliament, 
and may carry out or engage in such other related assignments or activities 
as may be authorized by the Governor in Council. 


ANNEX A 19 


ES 


(7) The Commissioner of the Communications Security Establishment | 
holding office immediately before the coming into force of this section 
shall continue in office for the remainder of the term for which he orshe | 
was appointed. 


273.65 (8) The Commissioner of the Communications Security Establishment shall 


review activities carried out under an authorization issued under this 
section to ensure that they are authorized and report annually to the 
Minister on the review. 


Security of Information Act 


15. 


20 


(1) No person is guilty of an offence under section 13 or 14 if the person 
establishes that he or she acted in the public interest. [...] 


(5) A judge or court may decide whether the public interest in the disclosure 
outweighs the public interest in non-disclosure only if the person has 
complied with the following: [...] 


(b) the person has, if he or she has not received a response from the deputy 
head or the Deputy Attorney General of Canada, as the case may be, 
within a reasonable time, brought his or her concern to, and provided all 
relevant information in the person’s possession to, [...] 


(1) the Communications Security Establishment Commissioner, if the 
person’s concern relates to an alleged offence that has been, 1s being 
or is about to be committed by a member of the Communications 
Security Establishment, in the purported performance of that 
person’s duties and functions of service for, or on behalf of, the 
Communications Security Establishment, and he or she has not | 


received a response from the Communications Security Establishment 
Commissioner within a reasonable time. 
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Classified Reports, 1996-2006 


. 


Classified Report to the Minister 
— March 3, 1997 (TOP SECRET) 


Classified Report to the Minister 
— Operational policies with lawfulness implications — February 6, 1998 
(SECRET) 


Classified Report to the Minister 
_ CSE’s activities under *** — March 5, 1998 (TOP SECRET Codeword/CEO) 


Classified Report to the Minister 
_ Internal investigations and complaints — March 10, 1998 (SECRET) 


Classified Report to the Minister 
_ CSE’s activities under *** — December 10, 1998 (TOP SECRET/CEO) 


Classified Report to the Minister 
~ On controlling communications security (COMSEC) material — May 6, 1999 
(TOP SECRET) 


Classified Report to the Minister 

_ How we test (A classified report on the testing of CSE’s signals intelligence 
collection and holding practices, and an assessment of the organization’s 
efforts to safeguard the privacy of Canadians) — June 14, 1999 (TOP SECRET 
Codeword/CEO) 


Classified Report to the Minister 
_A study of the *** collection program — November 19, 1999 (TOP SECRET 


Codeword/CEO) 


Classified Report to the Minister 
— On *** — December 8, 1999 (TOP SECRET/COMINT) 


. Classified Report to the Minister 


— A study of CSE’s *** reporting process — an overview (Phase I) — 
December 8, 1999 (SECRET/CEO) 


. Classified Report to the Minister 


— A study of selection and *** — an overview — May 10, 2000 
(TOP SECRET/CEO) 
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Classified Report to the Minister 
— CSE’s operational support activities under *** — follow-up — May 10, 2000 
(TOP SECRET/CEO) 


Classified Report to the Minister 
— Internal investigations and complaints — follow-up — May 10, 2000 (SECRET) 


Classified Report to the Minister 
— On findings of an external review of CSE’s ITS program — June 15, 2000 
(SECRET) 


Classified Report to the Minister 
— CSE’s policy system review — September 13, 2000 (TOP SECRET/CEO) 


Classified Report to the Minister 
— A study of the *** reporting process — *** (Phase II) — April 6, 2001 
(SECRET/CEO) 


Classified Report to the Minister 
— A study of the *** reporting process — *** (Phase III) — April 6, 2001 
(SECRET/CEO) 


Classified Report to the Minister 
— CSE’s participation *** — August 20, 2001 (TOP SECRET/CEO) 


Classified Report to the Minister 
— CSE’s support to ***, as authorized by *** and code-named *** 
— August 20, 2001 (TOP SECRET/CEO) 


Classified Report to the Minister 

— À study of the formal agreements in place between CSE and various external 
parties in respect of CSE’s Information Technology Security (ITS) — August 21, 
2002 (SECRET) 


Classified Report to the Minister 
— CSE’s support to ***, as authorized by *** and code-named *** — November 
13, 2002 (TOP SECRET/CEO) 


Classified Report to the Minister 


— CSE’s *** activities carried out under the *** 2002 *** Ministerial 
authorization — November 27, 2002 (TOP SECRET/CEO) | 
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3. Classified Report to the Minister 
— Lexicon of CSE definitions — March 26, 2003 (TOP SECRET) 


4. Classified Report to the Minister 
— CSE’s activities pursuant to *** Ministerial authorizations including *** 
— May 20, 2003 (SECRET) 


5. Classified Report to the Minister 
— CSE’s support to ***, as authorized by *** and code-named *** — Part I 
— November 6, 2003 (TOP SECRET/COMINT/CEO) 


6. Classified Report to the Minister 
— CSE’s support to ***, as authorized by *** and code-named *** — Part Il 
— March 15, 2004 (TOP SECRET/COMINT/CEO) 


7. Classified Report to the Minister 
_ A review of CSE’s activities conducted under *** Ministerial authorization 
— March 19, 2004 (SECRET/CEO) 


28. Classified Report to the Minister 
— Internal investigations and complaints — follow-up — March 25, 2004 
(TOP SECRET/CEO) 


29. Classified Report to the Minister 
_ A review of CSE’s activities conducted under 2002 *** Ministerial 
authorization — April 19, 2004 (SECRET/CEO) 


30. Classified Report to the Minister 
— Review of CSE *** operations under Ministerial authorization — June 1, 2004 
(TOP SECRET/COMINT) 


31. Classified Report to the Minister 
— CSE’s support to *** — January 7, 2005 (TOP SECRET/COMINT/CEO) 


32. Classified Report to the Minister 
_ External review of CSE’s *** activities conducted under Ministerial 
authorization — February 28, 2005 (TOP SECRET/COMINT/CEO) 


33. Classified Report to the Minister 


— A study of the *** collection program — March 15, 2005 
(TOP SECRET/COMINT/CEO) 
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Classified Report to the Minister 
— Report on the activities of CSE’s *** — June 22, 2005 (TOP SECRET) 


Classified Report to the Minister 
— Interim report on CSE’s *** operations conducted under Ministerial 
authorization — March 2, 2006 (TOP SECRET/COMINT) 


Classified Report to the Minister 


— External review of CSE *** activities conducted under Ministerial authorization 
— March 29, 2006 (TOP SECRET/CEO) | 
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statement of Expenditures 2005-2006 


standard Object Summary 


salaries and Wages 

[ransportation and Telecommunications 
information 

Professional and Special Services 

Rentals 

Purchased Repair and Maintenance 
Materials and Supplies 

Acquisition of Machinery and Equipment 
Other Expenditures 


Total 
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$527,760 
16,655 
24,177 
321,484 
132,326 
426 

7,155 
9,591 
3,966 
$1,043,540 
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History of the Office of the Communications Security Establishment 
Commissioner (OCSEC) 


The Office of the Communications Security Establishment Commissioner was 
created on June 19, 1996, with the appointment of the inaugural Commissioner, The 
Honourable Claude Bisson, O.C., a former Chief Justice of Quebec, who held the 
position until June 2003. He was succeeded by the Right Honourable Antonio Lamer, 
PC., C.C., C.D., LL.D., D.U., Chief Justice of Canada (retired) for a term of three 
years. 


For the first six years (from June 1996 to December 2001), the Commissioner carried 
out his duties under the authority of Orders in Council issued pursuant to Part IT of the 
Inquiries Act. During this period, the Commissioner’s responsibilities were twofold: to 
review the activities of the Communications Security Establishment (CSE) to deter- 
mine whether they conformed with the laws of Canada; and to receive complaints 
about CSE’s activities. 


Following the terrorist attacks in the United States on September 11, 2001, Parliament 
adopted the omnibus Anti-Terrorism Act which came into force on December 24, 
2001. The omnibus Act introduced amendments to the National Defence Act, by 
adding Part V.1 and creating legislative frameworks for both OCSEC and CSE. It also 
gave the Commissioner new responsibilities to review activities carried out by CSE 
under a ministerial authorization. 


The omnibus legislation also introduced the Security of Information Act that replaced 
the Official Secrets Act. This legislation gives the Commissioner specific duties in the 
event that a person, who would otherwise be permanently bound to secrecy, seeks to 
defend the release of classified information about CSE on the grounds that it is in the 
public interest. 


Under the Commissioner’s current mandate, which entrenched in law the original 
mandate established in 1996 as well as the additional responsibilities described above, 
the Commissioner has retained the powers of a commissioner under Part IT of the 
Inquiries Act. 
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ANNUAL REPORT 


INTRODUCTION 


This is my first report as Communications Security Establishment (CSE) 
Commissioner, since my appointment effective August |, 2006. I have a 
three-year mandate that expires in August 2009. 


My own background includes 30 years’ experience on the bench, most 
recently as a Supreme Court Justice from 1989-2003. I believe there are 
strong parallels between the role of a judge and that of the CSE 
Commissioner. A judge’s fundamental concern is to ensure fair trials and 
protect personal liberty, while maintaining peace and security. 
Correspondingly, the CSE Commissioner’s fundamental concern is to bal- 
ance the right to privacy with the need for information to protect national 
security. The similarity between these roles is reflected in the legislation 


specifying that the Commissioner be a supernu- - 


| ut CSE Commissioner's 
merary judge or a retired judge of a superior court. 


fundamental concern is to 


There is, however, an important difference in con- | balance the right to 
text. While secrecy issues do arise in court pro- il with the need for 


ceedings in certain instances, for the most part 


| : 


intelligence collection. Nevertheless, the balancing principles are the 


formation to protect 
the judicial process takes place in public. Secrecy, ae | 

tional security. 
on the other hand, is at the very heart of foreign es Y 


same. I see the role of my office as providing Canadians with the assur- 
ance that the CSE’s critical intelligence work is being carefully exam- 
ined by an impartial authority to ensure it is lawful, and that their rights 
are being protected, without compromising the secrecy required to pro- 
tect national security. 


In October 2006, I was presented with an exceptional opportunity to 
attend the International Intelligence Review Agencies Conference in 
Cape Town, South Africa. One of the conference themes was the need to 
balance the traditional rights and liberties of citizens with the need for 
increased powers to meet threats to national security. It was a remarkable 
experience to meet with the practitioners in security and intelligence 
review from 14 countries, including my own, and to hear from them 
first-hand about the challenges we all face. I remain grateful for this 
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opportunity because it provided an occasion for me, as the new CSE 


Commissioner, to become totally immersed in topics of mutual interest 
in the company of experts. 


During the early days following my appointment, I met the Minister of 
National Defence and the Chief of CSE. I was also provided with exten- 
sive briefings and tours, many of them at CSE, and I am particularly grate- 
ful to my briefers for their comprehensive presentations. As time pro- 
gressed, I had the opportunity to meet other federal government officials, 
including the Auditor General of Canada and the Privacy Commissioner, 
the Chairs of the Security Intelligence Review Committee and the 
Commission for Public Complaints Against the RCMP, the Deputy 
Minister of National Defence, and the National Defence Ombudsman. 


Most important, of course, has been the time I have spent involving 
myself in the work of my office, and familiarizing myself with the activi- 
ties and preoccupations of my predecessors, which will be discussed 
later in this report. 


THE REVIEW ENVIRONMENT 


A number of key issues helped shape the environment in which this 
office carried out its work over the past year. Some of these have been 
described and commented on by my predecessors in past Annual 
Reports. Below, I draw attention to some themes that have not been men- 
tioned before, as well as some new developments in ongoing issues. 


Legal interpretations 


Since the omnibus Anti-Terrorism Act was proclaimed in December 
2001, the persons who have occupied the position of CSE Commissioner 
have faced a persistent dilemma arising from the amendments this Act 
introduced to the National Defence Act. Particularly troublesome has 
been the Commissioner’s duty to review the activities of CSE conducted 
under ministerial authorizations issued for the sole purpose of obtaining 
foreign intelligence, given the lack of agreement on the interpretation of 
key provisions of the Act. 
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On the one hand, my predecessors and I have recognized the importance 
of CSE’s work, and the benefit the Government of Canada derives from 
the foreign intelligence CSE provides, particularly during a time when 
the threat of global terrorism continues unabated, and the safety of our 
soldiers in Afghanistan remains at risk. 


On the other hand, during our respective terms as Commissioner, each 
of us has been unequivocal in the position that the legal interpretation 
and advice regarding ministerial authorizations provided to CSE by the 
Department of Justice is not supported by a simple reading of the 
appropriate provisions of Part V.1 of the National Defence Act, and each 
of us so advised the Minister of National Defence of the day. In addi- 
tion, my immediate predecessor, the Right Honourable Antonio Lamer 
and I both made our positions known to officials at the Office of the 
Attorney General of Canada. 


When I am asked to consider whether an activity is lawful, I must first 
determine what the law states in respect of that activity. The relevant Act, 
then, is the yardstick by which the lawfulness of the activity is measured. 
The difficulty arises, in instances such as this, when there is a fundamen- 
tal difference of opinion about what the Act states. 


I do not question the role of the Department of a 

Justice in the drafting of legislation, nor do I Z The legislation lacks clarity 

view my role as Commissioner as arbiter of | one it ought to be amended. 
\ Hi 


informed the Minister of National Defence and the Attorney General of 


ZF 
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statutory interpretation. However, as I have 


Canada, the legislation lacks clarity and it ought to be amended, a view 
I share with both my predecessors. 


This matter has been under deliberation for some time, and I hope the 
government will make the required amendments at the earliest opportu- 
nity. I am confident that this will not be too onerous a task because other 
countries have successfully adopted and are applying legislation to meet 
similar requirements. 
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Legislation lagging behind technological 
advances 


As time goes on, there is an ever-widening knowledge gap between the 
general public and evolving technologies. In a number of respects, 
Canada’s laws have also not kept pace with technological advances. We 
need a more imaginative approach. Today, criminal and terrorist ele- 
ments are masters of these complex technologies and, unlike democratic 
institutions, are unimpeded by legal constraints. Those involved in the 
legislative process need to avoid laws that are driven by the technology 
of the day, which will in short order be superseded by new develop- 
ments. Instead, we must ensure our laws have a broad enough scope, and 
are so structured — be it by providing for regulations or otherwise — 
that they can accommodate new technologies, and continue to protect 
both our privacy and security. 


Three-year review of the Anti-Terrorism Act 


The Anti-Terrorism Act amended the Official Secrets Act and the 
National Defence Act, among other legislation. The amendments to the 
National Defence Act included a legislative basis for CSE and the 

CSE Commissioner. 


The Anti-Terrorism Act required a review of its provisions and operation 
within three years of receiving royal assent, to be carried out by a desig- 
nated or specially established committee of the Senate or the House of 
Commons, or of both chambers. A Subcommittee of the House of 
Commons Standing Committee on Public Safety and National Security 
was established for this purpose in autumn 2004. At the same time, the 
Senate established a Special Committee to carry out a comprehensive 
review of the Act. As described in the 2005-2006 Annual Report, my 
predecessor appeared before the Senate Special Committee on June 13, 
2005, and two days later before the House of Commons Subcommittee. 
The Senate Special Committee reported on February 22, 2007, and the 
House Subcommittee reported on March 27, 2007. 
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Senate Special Committee recommendations 


The Senate Special Committee made several recommendations concern- 
ing CSE as well as this office. As regards CSE, the Committee focussed 
primarily on ministerial authorizations, stating that it accepted the expla- 
nations as to why CSE needs to intercept private communications when 
undertaking its foreign intelligence and information technology security 
activities. It also accepted Commissioner Lamer’s explanation that min- 


isterial authorizations were the proper instrument 3 Commitee ee 
to use for intercepting private communications, SO 

rather than prior judicial authorization, because «ee 
warrants from Canadian courts have no jurisdic- | iso fee is required to 
tion outside Canada.! The Committee drew com- | 
fort from the fact that this office is required to 
review the lawfulness of CSE’s activities, includ- A. 

ing the interception of private communications + water authori- 
zations. However, it remained concerned, as was Commissioner Lamer, 
that the standard required to satisfy the Minister that all necessary pre- 
conditions to intercepting private communications have been met 1S 
unclear. Accordingly, the Committee recommended that subsections 
273.65(2) and (4) of the National Defence Act be amended to clarify 
whether these preconditions should be based on reasonable belief or rea- 
sonable suspicion.” This has been an issue of interest to my office, and a 
clarification would be welcome. 


Because the Committee wished to ensure that intercepted information 1S 
disposed of if it has been determined to be non-essential or when it is no 
longer essential, it recommended that CSE develop information retention 
and disposal policies, containing specific timeframes for the disposal of 
intercepted information, and that it make these policies publicly available. 


| Special Senate Committee on the Anti-Terrorism Act, Fundamental Justice in Extraordinary Times: 
Main Report of the Special Senate Committee on the Anti-Terrorism Act, February 2007, p. 77. 

2 Jbid., Recommendation 18, p. 78. 

3 Jbid., Recommendation 19, p. 79. 
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In the interests of accountability and transparency, the Committee also 
recommended that the Minister of National Defence or the CSE be 


required to report annually to Parliament on the number of ministerial 
authorizations issued during the year, the number still in force by the end 
of the year, and the general purpose for which each authorization was 
issued (1.e., to obtain foreign intelligence or to protect computer systems 
or networks).4 


The Anti-Terrorism Act also amended the Official Secrets Act, and 
renamed it the Security of Information Act, known as SOIA. SOIA 
establishes a process that persons permanently bound to secrecy 
must follow if they wish to claim a public interest defence for 
divulging classified information. The Commissioner may receive 
classified information as part of the process (see Annex A). 
However, the Security of Information Act does not describe what 
should be done once the Commissioner receives that information.> 
The Committee recommended that the Government specify the 
procedure to be followed in such cases.f I should point out that my 
office does have internal policies and procedures in place to fill 
the gap that the Committee identified. 


Lastly, the Committee discussed the oversight and review of Canada’s 
national security and anti-terrorism framework. The Committee men- 
tioned that this office is “generally perceived to be an effective oversight 
mechanism.”’ The Committee recommended that a standing Senate com- 
mittee be established to monitor and periodically report on Canada’s 
anti-terrorism legislation and national security framework on an ongoing 
basis. In addition, the Committee called for a comprehensive parliamen- 
tary review of the provisions and operation of the Anti-Terrorism Act 
every five years. 


* Ibid., Recommendation 20, p. 79. 

> To date, I have not received any information under the Security of Information Act. 
° Supra, footnote 1, Recommendation 26, p. 94. 

7 Supra, footnote 1, p.116. 
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House of Commons Subcommitiee 
recommendations 


The House Subcommittee’s Final Report on its review of the Anti- 
Terrorism Act also addressed the issue of ministerial authorizations. In 
particular, I was pleased to note that the Subcommittee drew attention to 
the remarks of my predecessor in his 2005-2006 Annual Report about the 
legal ambiguities and uncertainties in the provisions allowing for ministe- 
rial authorizations, and the disagreement regarding interpretation of these 
provisions between this office and the Department of Justice. Without 
making a specific recommendation in this regard, the Subcommittee 
urged government counsel and me to resolve these issues as expeditiously 
as possible. As well, the Subcommittee requested that the Government's 
response to the Final Report indicate what the issues of disagreement are 
and how they have been resolved, to the extent possible. Failing this, the 
Subcommittee believes I should provide these details in my 2007-2008 
Annual Report.’ I intend to revisit this recommen- 


dation as the time for that report approaches. \ 
à methodology always 

The Subcommittee also supported a recommenda- ‘includes an examination of 
tion by the Privacy Commissioner that subsection 
273.65(8) of the National Defence Act be amended 
to require the CSE Commissioner to review the pri- 


"Charter and the Privacy Act. 
N 


vate communication interception activities carried out under ministerial 
authorization to ensure they comply with the requirements of the Canadian 
Charter of Rights and Freedoms and the Privacy Act, as well as with the 
authorization itself. This position was reinforced with an additional recom- 
mendation that section 273.66 of the National Defence Act be amended to 
require the CSE only to undertake activities consistent with the Canadian 
Charter of Rights and Freedoms and the Privacy Act, in addition to the 
restraints on the exercise of its mandate already set out in that section.” I 
should point out that my office’s review methodology always includes an 
examination of compliance with the Charter and the Privacy Act. 


8 Subcommittee on the Review of the Anti-Terrorism Act, Rights, Limits, Security: A Comprehensive 
Review of the Anti-terrorism Act and Related Issues. Final Report of the Standing Committee on 
Public Safety and National Security, March 2007, p. 56. 

9 Jbid., Recommendations 44 and 45, pp. 55-56. 
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With respect to the issue of review and oversight, the Subcommittee rec- 
ommended that Bill C-81 from the 38™ Parliament, the proposed 
National Security Committee of Parliamentarians Act, or a variation of 
it, be introduced in Parliament at the earliest opportunity. The 
Subcommittee further recommended that the mandate of the proposed 
committee include undertaking compliance audits of departments and 
agencies, such as CSIS, CSE, and national security elements of the 
RCMP, in relation to the provisions of the Anti-Terrorism Act.'° In last 
year’s Annual Report, my predecessor welcomed the prospect of more 
active parliamentary review of national security activities, but also noted 
challenges such as the composition of the committee and its access to 
classified information and documents. I concur with that position in gen- 
eral, and intend to offer specific comments once a bill is introduced. 


Finally, the Subcommittee recommended that there be another compre- 
hensive review of the provisions and operation of the Anti-Terrorism Act, 
to begin no later than December 31, 2010, and to be completed no later 
than December 31, 2011. It noted that the proposed committee of parlia- 
mentarians would be well-equipped to carry out this review. !! 


The O’Connor Commission of Inquiry 


The Commission of Inquiry into the Actions of Canadian Officials in 
Relation to Maher Arar was established February 5, 2004. It was man- 
dated to investigate and report on the actions of Canadian officials in 
relation to Maher Arar (Factual Inquiry) as well as to recommend an 
arm’s-length review mechanism for the activities of the RCMP with 
respect to national security (Policy Review). The Honourable Dennis 
O'Connor was appointed Commissioner of the Inquiry. He released his 
Policy Review report on December 12, 2006. 


'° Tbid., Recommendations 58 and 59, pp. 84-86. 
I Tbid., pp. 83-85. 
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In order to provide integrated review of integrated national security 
activities, Commissioner O’Connor recommended that statutory gate- 
ways be enacted linking the proposed Independent Complaints and 
National Security Review Agency for the RCMP, the Security 
Intelligence Review Committee and the Office of the CSE 
Commissioner to provide for exchange of information, referral of inves- 
tigations, conduct of joint investigations, and coordination and prepara- 
tion of reports. !? I welcome this proposal, although to date the absence 
of gateways has never been an operational impediment. 


I was pleased to note the following observation from Justice O’Connor’s 
report: “I am not recommending that SIRC’s mandate be expanded to 
include the CSE, as I understand that the Office of the CSE 
Commissioner functions very well and I see no reason to interfere with 
that operation.”'? I was also pleased to see that my office was recognized 
for the creation of the Review Agencies Forum in 2005-2006.'* The 
Forum is described further on in this report. 


I do have reservations, however, regarding Justice O’Connor’s recom- 
mendation to establish an Integrated National Security Review 
Coordinating Committee.'? I am concerned that introducing such a coor- 
dinating committee by way of statute, and amendments to related legisla- 
tion, may create an unnecessary and counter-productive level of bureau- 
cracy between independent review agencies and Parliament. 


12 Commission of Inquiry into the Actions of Canadian Officials in Relation to Maher Arar, A New 
Review Mechanism for the RCMP’s National Security Activities (Ottawa: Public Works and 
Government Services Canada, 2006), p. 578. 

13 Jbid., Recommendation 11, p. 580. 

14 Tbid., p. 282. 

15 Jbid., Recommendation 12, p. 591. 
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‘ | was pleased to note that 
the findings of the 
administrative review were The reports of these management reviews were 


THE YEAR IN REVIEW 


Independent Reviews of OCSEC 


In spring 2006, two independent management reviews of my office were 
commissioned. One focussed on administration, including the manage- 
ment and control of financial, human and information resources. The 
other dealt with operations, by assessing whether the office carries out 
the Commissioner’s mandated responsibilities 
efficiently and effectively. 


available to me at the time of my appointment, 

thus providing me with an independent assessment 
of my new area of responsibility. I was pleased to note that the findings of 
the administrative review were all positive. The recommendations of the 
operational review were discussed in detail at a review workshop held 
on August 21, 2006, with the review consultants as moderators. The 
operational review also raised methodology issues, which will be briefly 
referred to later in this report. 


Workplan 


My office’s activities are guided by a regularly updated three-year work- 
plan. To facilitate scheduling, my staff consult with CSE about the 
review components of this plan. Criteria that determine their selection of 
topics for review include: CSE activities or programs that have not previ- 
ously or recently been reviewed; areas identified from briefings request- 
ed of CSE; the status of recommendations from previous reviews; and 
activities where privacy is most likely to be at risk. My staff, who have 
extensive knowledge of CSE, ask themselves fundamental questions 
such as: what can go wrong; what is the probability of something going 
wrong; and what are the consequences if they do go wrong. 


Also during the year, considerable staff time and resources were devoted 


to work on legal interpretation issues, which I have already described in 
detail above in my discussion of the review environment. 
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Reviews undertaken of CSE 


My general review mandate is set out in paragraph 273.63(2)(a) of the 
National Defence Act.\ Under subsection 273.65(8) of the Act, I also 
have an obligation to review and report to the Minister as to whether the 
activities carried out under a ministerial authorization are authorized. 


Ministerial authorizations for foreign intelligence collection are issued 
under the authority of subsection 273.65(1) of the National Defence Act, 
whereas ministerial authorizations for information technology security 
activities are issued under subsection 273.65(3) of the Act. Reviews of 
CSE’s activities conducted under ministerial authorizations are undertak- 
en only after the ministerial authorization has expired. 


During 2006-2007, my office submitted classified reports of four reviews 
to the Minister. Two of the reviews dealt with CSE’s activities conducted 
under ministerial authorization; one pertained to foreign intelligence col- 
lection, while the other concerned information technology security. The 
other two reviews were conducted under my general mandate, to ensure 
the activities were in compliance with the law. 


16 Please see Annex A for the text of the relevant sections of the National Defence Act. 
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2006-2007 REVIEW HIGHLIGHTS 


Review of CSE’s foreign intelligence collection 
in support of the RCMP 


Background 

In January 2005, my office submitted a report to the Minister of National 
Defence examining the technical and operational assistance CSE provid- 
ed to the RCMP under paragraph 273.64(1)(c) of the National Defence 
Act, also known as mandate (c).!’ The second and final phase of the 
review was completed and in June 2006, my predecessor submitted a fol- 
low-up report reviewing CSE’s foreign signals intelligence collection 
activities in support of the RCMP under pararagraph 273.64(1)(a) of the 
National Defence Act, also known as mandate (a). Further details on the 
first phase of the review may be obtained in the 2004-2005 Annual 
Report of this office. 


Under mandate (a), CSE provides two kinds of foreign intelligence 
information to its government clients, including the RCMP. Most of its 
reports address general areas of interest that complement and support the 
client’s own mandated responsibilities. In addition to this proactive sup- 
port, CSE provides reactive support by responding to specific requests 
by the client for intelligence-related information. 


Methodology 

OCSEC staff examined CSE’s mandate (a) activities in support of the 
RCMP for the period January 1 to December 31, 2003. They received 
briefings and answers to both verbal and written questions that were 
posed to CSE officials. They also obtained a listing of the agency’s 
requests for intelligence-related information and chose several to exam- 
ine in detail. As part of this in-depth examination, two separate demon- 
strations illustrating the activities under review were provided to OCSEC 
staff by those CSE officials who had been directly involved in respond- 
ing to the requests. 


17 CSE’s mandate is described in Annex E of this report. 
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Findings 
Many of the findings and recommendations made in my office’s first 
report also applied to this second-phase review of assistance provided 
under mandate (a). For example, it was recommended CSE amend and/or 
update the instruments that guide its support activities to the RCMP. My 
predecessor was pleased to report that, for the | 


‘CSE has advised that high 
priority has been given to 
the development and 
implementation of a 

; corporate records 


most part, CSE had accepted these recommenda- 


tions and is working to implement them. 


CSE also acknowledged the need to implement a 
formal system of record keeping. This is a contin- 


uing concern, as was noted in my office’s 2005- 
: . management system. 
l 


2006 Annual Report. CSE has advised that high 
priority has been given to the development and implementation of a cor- 
porate records management system that will deal with their hard-copy 
and electronic records requirements. 


/ 


During the second phase of the review, a detailed examination of CSES 
response to RCMP requests for intelligence-related information identi- 
fied two issues of concern that required further legal study by CSE. The 
first was whether mandate (a) was the appropriate authority in all 
instances for CSE to provide intelligence support to the RCMP in the 
pursuit of its domestic criminal investigations. Pending a re-examination 
of this issue by CSE, no assessment was made of the lawfulness of 
CSE’s activities in support of this agency under mandate (a) as currently 
interpreted and applied by CSE. My staff is monitoring the issue. 


The second issue related to CSE’s policies and practices as they relate to 
the disclosure of Canadian personal information to its clients. When col- 
lecting foreign intelligence, CSE may incidentally acquire personal 
information about Canadians. This information may be retained if 
assessed as essential to the understanding of the foreign intelligence, and 
it may be included in foreign intelligence reporting if it is Suppressed 
(i.e. replaced by a generic reference such as “a Canadian person”). When 
receiving a subsequent request for disclosure of the full details of 
Canadian personal information, CSE requires its clients, including the 
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RCMP, to justify their authority to collect this information under their 
own respective mandates and provide an operational justification of their 


need to know this information. If these conditions are met, CSE releases 
the information. 


An in-depth examination of relevant sections of the National Defence 
Act and the Privacy Act raised questions as to CSE’s conformance with 
the various authorities that govern disclosure. Thus, my office recom- 
mended that CSE also re-examine its authority to collect, use and dis- 
close personal information to certain federal government departments 
and agencies. In addition, my office has recommended that CSE estab- 
lish agreements with client agencies to formalize the circumstances 
when such information may be disclosed while providing assistance 
under its (c) mandate. 


CSE acknowledged that the report “raises a number of issues that, from a 
policy/legal perspective, will generate further in-depth analysis by CSE 
and Department of Justice legal counsel.” I anticipate that this analysis 
will include a discussion and perhaps even a formal articulation by CSE 
of its position regarding the application of the National Defence Act as it 
relates to the provision of foreign intelligence in accordance with the 
Government of Canada intelligence priorities. 


Review of information technology security 
activities at a government department 


Background 

This review examined information technology security activities con- 
ducted by CSE under ministerial authorization in 2004-2005 at a govern- 
ment department. The objective was to assess and verify compliance 
with the law and with the provisions of the ministerial authorization for 
these activities. 
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Individuals conducting personal and business affairs with the 


Government of Canada have a reasonable expec- EE, |. . : 
. Individuals conducting 


tation of privacy. However, when the security of ae 
government computer systems and networks is ae al and business 
ffairs with the 


being tested, personal information or private À 
overnment of Canada 


communications can be inadvertently intercepted 
with certain types of necessary testing. 
Subsection 273.65(3) of the National Defence Act 
provides that: 


ha > a reasonable 
xpectation of privacy. 


The Minister may, for the sole purpose of protecting the com- 
puter systems or networks of the Government of Canada from 
mischief, unauthorized use or interference, in the circum- 
stances specified in paragraph 184(2)(c) of the Criminal 
Code, authorize the Communications Security Establishment 
in writing to intercept private communications in relation to 
an activity or class of activities specified in the authorization. 


In such cases, CSE is responsible for seeking authorization on behalf of 
the department or agency requesting the activity to be covered. This min- 
isterial authorization enables CSE to undertake a complete assessment of 
a department’s computer systems and networks. 


Methodology 

The review was conducted initially through examination of documents 
and files related to the ministerial authorization and the conditions 
imposed by it. Fact-finding and verification interviews were then held 
with CSE and selected client representatives who were identified as hav- 
ing direct involvement in the authorization process or ensuing activities. 


Findings 

With the qualification set out below regarding one of the conditions of 
the ministerial authorization, this review found that CSE’s work at the 
department was in compliance with the law and with the ministerial 
authorization. 


The review found that the process by which CSE acquired the informa- 


tion technology security ministerial authorization for its activities at the 
department was found to be in accordance with the requirements of the 
National Defence Act. It was also determined that four of the five condi- 
tions set out in subsection 273.65(4) of the Act were complied with satis- 
factorily. However, with respect to one of the conditions, the review 
found that certain information was retained even though its retention was 
not essential. While CSE personnel acted in a manner that was consistent 
with the direction they were given, there were aspects that could be 
improved upon, and CSE has undertaken to do so. CSE has also indicat- 
ed that future Memoranda of Understanding with client departments 
where information technology security activities under ministerial 
authorizations are to be conducted will reflect these improvements. 


Other recommendations from the review included ensuring that future 
policy and practice promote conformance with CSE’s legislated authori- 
ties as they relate to staff activities during information technology securi- 
ty exercises. 


Review of the roles of CSE’s client relations offi- 
cers and the Operational Policy Section in the 
release of personal information 


Background 

The objective of this review was to assess the lawfulness of the activities 
of both the CSE client relations officers and the Operational Policy 
Section, as they relate to the request for and release of personal informa- 
tion about Canadians that has been suppressed in CSE foreign intelligence 
reports, as referred to previously. This information is made available to 
authorized Government of Canada clients, only under certain conditions. 


CSE has provided foreign intelligence reports based on signals intelligence 
to officials in government departments since its formal establishment in 
1946. Reports were delivered by hand until the creation of the on-site 
client relations officer programme in 1985. Client relations officers 
provide intelligence reports, explain to individual clients and potential 
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clients the role of CSE and signals intelligence, and assist in determining 
client needs based on Government of Canada intelligence priorities. 


To protect privacy, CSE suppresses personal information about Canadians 
in foreign intelligence reports. If a client has both the authority and 
the need to know the information, it must make a formal request and pro- 


vide justification. Requests for release of this AN 
information are centralized in CSE’s Operational 


To protect privacy, CSE 


Policy Section. rr esses personal 


ation about 
The majority of requests are now made via a 


anadians in foreign 
eh reports. 


secure communication network directly to CSE. 
Client relations officers play a role in the release 
of Canadian identities in CSE foreign intelligence reports because they 
continue to deal with requests from clients who do not have access to 
this secure network. 


Methodology 

This review examined relevant documentation, including the authorities 
that govern the activities of client relations officers and the CSE unit 
authorized to release this information. All requests for and releases of 
suppressed information during a six-month period were reviewed in 
detail to ensure compliance with law and policy. Interviews were con- 
ducted with client relations officers, their managers, and the manager of 
the Operational Policy Section. 


Findings 

The review concluded that the activities of the CSE client relations offi- 
cers and the Operational Policy Section were in compliance with the 
National Defence Act and with CSE’s related policies. There were some 
inconsistencies in requests and releases, as well as areas where both poli- 
cy and practice could be improved to enhance the protection of privacy, 
as required by the Privacy Act. Recommendations included more com- 
prehensive training for clients who make requests, and providing more 
clients with secure, electronic access to CSE as a means of reducing 
errors and enhancing control over the process. I was pleased to note that 
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since the period of review there has also been increased training for and 
supervision of personnel in the Operational Policy Section at CSE as 
regards the release of suppressed information. 


Review of CSE signals intelligence collection 
activities conducted under ministerial authori- 
zations 


Background 

Certain foreign intelligence collection activities were conducted under 
three ministerial authorizations that were in effect from March 2004 to 
December 2006. These ministerial authorizations focused on acquiring 
communications of foreign intelligence value from the global informa- 
tion infrastructure. !® 


The characteristics of contemporary communications technology mean 
that the interception of communications by CSE, directed at foreign enti- 
ties outside Canada, runs the inherent risk of acquiring the private com- 
munications of Canadians. It is for this reason that a ministerial authori- 
zation is sought for this collection. In addition to the conditions set out in 
subsection 273.65(2) of the National Defence Act, a ministerial directive 
established other conditions for managing the collection. 


My office is undertaking a two-part review of the activities under these 
ministerial authorizations, as the law is interpreted by the Department of 
Justice, a point which is discussed below. The objective of this first 
phase was to provide background to, and criteria for, the detailed review 
of these complex activities. I provided the Minister of National Defence 
with a brief report on this study phase in February 2007. 


18 “Global information infrastructure” includes electromagnetic emissions, communications sys- 
tems, information technology systems and networks, and any data or technical information carried 
on, contained in, or relating to those emissions, systems or networks. (National Defence Act, sec- 
tion 273.61) 


ANNUAL REPORT 


. Methodology 

| In order to establish an understanding of this foreign intelligence collec- 
tion and the unique challenges it presents, this first phase of the review: 
studied the authorities given to and the conditions imposed upon CSE by 
the ministerial authorizations, ministerial directive and related articles; 
and examined how CSE has responded in terms of the policies and pro- 
cedures that it has developed, and the management framework that has 
been put in place to oversee these activities. 


Findings 

This study phase developed an historical perspective and appreciation of 
the rationale for this collection activity. It also provided an appreciation 
of the organizational complexities, the authorities under which it oper- 
ates, the conditions imposed and the programs in place to implement the 
authorities while respecting the conditions. Finally, it established the 
review criteria for the second and final phase, which is now underway. 


Overview of 2006-2007 findings 


Lam able to report that, overall, the activities of CSE examined during 
this reporting period complied with the law, with one qualification. It 
concerned a condition of an information technology security ministerial 
authorization, which CSE has already undertaken to rectify. A report of 
CSE’s assistance to the RCMP did not provide an assessment of the law- 
fulness of the activities reviewed, pending a re-examination by CSE of 
the legal issues raised. 


With respect to the review of CSE’s signals intelligence collection activi- 
ties conducted under ministerial authorization, I would highlight once 
again my disagreement with the Department of Justice’s interpretation of 
the ministerial authorization provisions of the National Defence Act. 
When assessing the lawfulness of activities conducted under ministerial 
authorizations, I have agreed to use the Department of Justice’s interpre- 
tation for the present pending amendments to the legislation, which I 
have already urged be made at the earliest opportunity. I commend the 
Chief of CSE for supporting this initiative. 


Reviews underway / future reporting 


Reviews currently underway that I will be reporting on in the next fiscal 
year include examinations of CSE’s activities related to counter-terror- 
ism, its use of metadata, its support to CSIS, its use of technology to pro- 
tect the privacy of Canadians, and its activities under a number of for- 
eign intelligence collection and information technology security ministe- 
rial authorizations. In addition, my office will begin a number of other 
reviews, under both my general mandate and my duties under the minis- 
terial authorization provisions. 


Complaints about CSE activities 


My mandate includes undertaking any investigation I deem necessary in 
response to a complaint, to determine whether CSE engaged, or is 
engaging in unlawful activity. 


During the 2006-2007 reporting year my office received no complaints 
that warranted formal investigation. However, OCSEC did complete 
one investigation in spring 2006 in response to a complaint that was 
received in the previous reporting year. A full report was delivered to 


. 1 the Minister of National Defence outlining the 
“lan am able fo report that the facts of the complaint and the findings resulting 


/ 


| Investigation found no from the investigation. 


Ac unlawful activity on fhe 
Le part CLOSE. While the substance of the complaint is classified, 


I am able to report that the investigation found no 
unlawful activity on the part of CSE. My office made recommendations 
that were accepted by CSE, and would strengthen compliance. 


Duties under the Security of Information Act 


I have a duty under the Security of Information Act to receive information 
from persons who are permanently bound to secrecy if they wish to claim 
a “public interest” defence for divulging classified information. No such 
matters were referred to my office in 2006-2007. 
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THE COMMISSIONER’S OFFICE 


I am supported in my work by a full-time staff of eight. Their extensive 
experience in the security and intelligence community is supplemented 
by subject matter experts in areas such as informatics, technology, 
research, policy development and communications, with whom my 
office contracts as required. 


Many of my office’s interests and concerns are shared by other Canadian 
security and intelligence review agencies. As Justice O’Connor noted, in 
2005-2006 my staff initiated the Review Agencies Forum, which brings 
them together at regular intervals with the staffs of the Security 
Intelligence Review Committee, the Office of the Inspector General of 
the Canadian Security Intelligence Service and the Commission for 
Public Complaints Against the RCMP. In 2006-2007, the Forum met 
twice to discuss issues such as the recommendations of Justice 
O’Connor’s Policy Review report, and amendments to the Public 
Servants Disclosure Act resulting from the new Federal Accountability 
Act (Bill C-2). In addition, Forum participants discussed how to provide 
their respective agencies with reasonable turnaround times in responding 
to reviews, and the different approaches that have been used when delays 
are encountered. 


My staff also participated in other conferences and symposia that provid- 
ed them with new perspectives on their work, including the International 
Intelligence Review Agencies Conference in Cape Town, which I 
described above, and the conferences of the Canadian Association for 
Security and Intelligence Studies (CASIS) and the Ontario Bar 
Association. In addition, as a developmental opportunity, my office host- 
ed two promising students at the CASIS conference. 
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While my office does not have a formal educa- 


- 2006-2007, there were tional mandate, I do believe it is important 

. some 96,000 visits fo my that Canadians know about OCSEC’s work. 
w oo To this end, my office hosts a website 

- (www.csec-ccst.gc.ca) that describes OCSEC’s 
mandate and activities. Visits to the site originating from outside North 


America span a global audience ranging from Europe to Asia and the 
Middle East. In 2006-2007, there were some 96,000 visits to my website. 


In 2006-2007, my office’s expenditures were $ 1,267,612, which was 
well within budget for the period. Annex C to this report provides a 
summary of 2006-2007 expenditures. 


LOOKING TO THE FUTURE 


The Major Commission of Inquiry and the 
lacobucci Internal Inquiry 


Two new inquiries that may have an impact on the future review environ- 
ment are the Commission of Inquiry into the Investigation of the 
Bombing of Air India Flight 182, led by the Honourable John Major, and 
the Internal Inquiry into the Actions of Canadian Officials in Relation to 
Abdullah Almalki, Ahmad Abou-Elmaati and Muayyed Nureddin, led by 
the Honourable Frank Iacobucci. 


The Air India Commission’s mandate is to make findings and recom- 
mendations regarding the assessments and actions of Canadian govern- 
ment officials before and after the 1985 bombing, and ways that any past 
mistakes can be avoided in the future. The Internal Inquiry is mandated 
to examine all aspects of the involvement of Canadian officials in 
relation to the detention of the three individuals in Syria or Egypt. 
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Review methodology 


One of the recommendations of the independent operational review of 
my office conducted in spring 2006 was to document formally the 
methodology employed by the office to examine CSE’s activities. I sup- 
port this initiative entirely and I am confident that the office will derive 
benefit from it now and in the longer term. This will be an important 
preoccupation over the summer months. 


IN CLOSING 


Looking back over the last eight months, I would like to express appreci- 
ation to my predecessor, the Right Honourable Antonio Lamer, from 
whom I inherited a fine staff and an organization well positioned to meet 
the challenges ahead. Thanks to this legacy, I was able to assume my 
responsibilities immediately upon my appointment, and the transition 
between our tenures was seamless. | 


I anticipate continuing the productive relation- 

ships that have been established with the Minister (= 
of National Defence, with CSE and with officials 

at other government departments and agencies involved in Canada’s 


1 ve been established. 


security and intelligence community. In particular, I look forward to dis- 
cussions that I trust will lead to a resolution of the legal interpretation 
issues that have beset this office since the passage of Part V.1 of the 
National Defence Act. 
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ANNEX A: MANDATE OF THE COMMUNICATIONS SECURITY 
ESTABLISHMENT COMMISSIONER 


National Defence Act — Part V.1 


273.63 (1) The Governor in Council may appoint a supernumerary judge or a retired 
judge of a superior court as Commissioner of the Communications Security 
Establishment to hold office, during good behaviour, for a term of not more 
than five years. 


(2) The duties of the Commissioner are 


(a) to review the activities of the Establishment to ensure that they are in 
compliance with the law; 


(b) in response to a complaint, to undertake any investigation that the 
Commissioner considers necessary; and 


(c) to inform the Minister and the Attorney General of Canada of any activity 
of the Establishment that the Commissioner believes may not be in 
compliance with the law. 


(3) The Commissioner shall, within 90 days after the end of each fiscal year, 
submit an annual report to the Minister on the Commissioner’s activities and 
findings, and the Minister shall cause a copy of the report to be laid before 
each House of Parliament on any of the first 15 days on which that House is 
sitting after the Minister receives the report. 


(4) In carrying out his or her duties, the Commissioner has all the powers of a 
commissioner under Part II of the Inquiries Act. 


(5) The Commissioner may engage the services of such legal counsel, technical 
advisers and assistants as the Commissioner considers necessary for the proper 
performance of his or her duties and, with the approval of the Treasury Board, 
may fix and pay their remuneration and expenses. 
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| 
(6) The Commissioner shall carry out such duties and functions as are assigned 
to the Commissioner by this Part or any other Act of Parliament, and may 


carry out or engage in such other related assignments or activities as may be 
authorized by the Governor in Council. 


(7) The Commissioner of the Communications Security Establishment holding 
office immediately before the coming into force of this section shall continue 
in office for the remainder of the term for which he or she was appointed. 


Rea 


273.65 (8) The Commissioner of the Communications Security Establishment shall 
review activities carried out under an authorization issued under this section 
to ensure that they are authorized and report annually to the Minister on 
the review. 


Security of Information Act 


15. (1) No person is guilty of an offence under section 13 or 14 if the person establishes 
that he or she acted in the public interest. [...] 


(5) A judge or court may decide whether the public interest in the disclosure out- 
weighs the public interest in non-disclosure only if the person has complied with 
the following: [...] 


(b) the person has, if he or she has not received a response from the deputy head 
or the Deputy Attorney General of Canada, as the case may be, within a rea- 
sonable time, brought his or her concern to, and provided all relevant infor- 
mation in the person’s possession to, [...] 


(ii) the Communications Security Establishment Commissioner, if the per- 
son’s concern relates to an alleged offence that has been, is being or is 
about to be committed by a member of the Communications Security 
Establishment, in the purported performance of that person’s duties and 
functions of service for, or on behalf of, the Communications Security 
Establishment, and he or she has not received a response from the 
Communications Security Establishment Commissioner within a reason- 
able time. 
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ANNEX B: CLASSIFIED REPORTS, 1996-2007 


10. 


Classified Report to the Minister 
— March 3, 1997 (TOP SECRET) 


Classified Report to the Minister 
— Operational policies with lawfulness implications — February 6, 1998 (SECRET) 


Classified Report to the Minister 
_ CSE’s activities under *** — March 5, 1998 (TOP SECRET Codeword/CEO) 


Classified Report to the Minister 
— Internal investigations and complaints — March 10, 1998 (SECRET) 


Classified Report to the Minister 
_ CSE’s activities under *** — December 10, 1998 (TOP SECRET/CEO) 


Classified Report to the Minister 
— On controlling communications security (COMSEC) material — May 6, 1999 
(TOP SECRET) 


Classified Report to the Minister 

— How we test (A classified report on the testing of CSE’s signals intelligence 
collection and holding practices, and an assessment of the organization’s efforts 
to safeguard the privacy of Canadians) — June 14, 1999 (TOP SECRET 
Codeword/CEO) 


Classified Report to the Minister 
— A study of the *** collection program — November 19, 1999 (TOP SECRET 
Codeword/CEO) 


Classified Report to the Minister 
— On *** — December 8, 1999 (TOP SECRET/COMINT) 


Classified Report to the Minister 
— A study of CSE’s *** reporting process — an overview (Phase I) 
— December 8, 1999 (SECRET/CEO) 


Classified Report to the Minister 
— A study of selection and *** — an overview — May 10, 2000 (TOP SECRET/CEO) 
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14. 


17. 


18. 


19. 


20. 


2 


28 


Classified Report to the Minister 
— CSE’s operational support activities under *** — follow-up — May 10, 2000 
(TOP SECRET/CEO) 


Classified Report to the Minister 
— Internal investigations and complaints — follow-up — May 10, 2000 (SECRET) 


Classified Report to the Minister 
— On findings of an external review of CSE’s ITS program — June 15, 2000 
(SECRET) 


Classified Report to the Minister 
— CSE’s policy system review — September 13, 2000 (TOP SECRET/CEO) 


Classified Report to the Minister 
— A study of the *** reporting process — *** (Phase II) — April 6, 2001 
(SECRET/CEO) 


Classified Report to the Minister 
— A study of the *** reporting process — *** (Phase IID) — April 6, 2001 
(SECRET/CEO) 


Classified Report to the Minister 
— CSF’s participation *** — August 20, 2001 (TOP SECRET/CEO) 


Classified Report to the Minister 
— CSE’s support to ***, as authorized by *** and code-named *** 
— August 20, 2001 (TOP SECRET/CEO) 


Classified Report to the Minister 

— A study of the formal agreements in place between CSE and various external 
parties in respect of CSE’s Information Technology Security (ITS) 
— August 21, 2002 (SECRET) 


Classified Report to the Minister 
— CSE’s support to ***, as authorized by *** and code-named *** 
— November 13, 2002 (TOP SECRET/CEO) 
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22. Classified Report to the Minister 
— CSE’s *** activities carried out under the *** 2002 *** Ministerial 
authorization — November 27, 2002 (TOP SECRET/CEO) 


23. Classified Report to the Minister 
— Lexicon of CSE definitions — March 26, 2003 (TOP SECRET) 


24. Classified Report to the Minister 
— CSE’s activities pursuant to *** Ministerial authorizations including *** 
— May 20, 2003 (SECRET) 


25. Classified Report to the Minister 
— CSE’s support to ***, as authorized by *** and code-named *** — Part I 
— November 6, 2003 (TOP SECRET/COMINT/CEO) 


26. Classified Report to the Minister 
—CSE’s support to ***, as authorized by *** and code-named *** — Part II 
— March 15, 2004 (TOP SECRET/COMINT/CEO) 


27. Classified Report to the Minister 
— A review of CSE’s activities conducted under *** Ministerial authorization 
— March 19, 2004 (SECRET/CEO) 


28. Classified Report to the Minister 
— Internal investigations and complaints — follow-up — March 25, 2004 
(TOP SECRET/CEO) 


29. Classified Report to the Minister 
— A review of CSE’s activities conducted under 2002 *** Ministerial authorization 
— April 19, 2004 (SECRET/CEO) 


30. Classified Report to the Minister 
— Review of CSE *** operations under Ministerial authorization — June 1, 2004 
(TOP SECRET/COMINT) 


31. Classified Report to the Minister 
— CSE’s support to *** — January 7, 2005 (TOP SECRET/COMINT/CEO) 
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Classified Report to the Minister 
— External review of CSE’s *** activities conducted under Ministerial authorization 
— February 28, 2005 (TOP SECRET/COMINT/CEO) 


Classified Report to the Minister 
— A study of the *** collection program — March 15, 2005 (TOP SECRET? 
COMINT/CEO) 


Classified Report to the Minister 
— Report on the activities of CSE’s *** — June 22, 2005 (TOP SECRET) 


Classified Report to the Minister 
— Interim report on CSE’s *** operations conducted under Ministerial authorization 
— March 2, 2006 (TOP SECRET/COMINT) 


Classified Report to the Minister 
— External review of CSE *** activities conducted under Ministerial authorization 
— March 29, 2006 (TOP SECRET/CEO) 


Classified Report to the Minister 
— Review of CSE’s foreign intelligence collection in support of the RCMP 
(Phase IT) — June 16, 2006 (TOP SECRET/COMINT/CEO) 


Classified Report to the Minister 
— Review of information technology security activities at a government department 
under ministerial authorization — December 18, 2006 (TOP SECRET) 


Classified Report to the Minister 

— Review of CSE signals intelligence collection activities conducted under 
ministerial authorizations (Phase I) — February 20, 2007 (TOP SECRET/ 
COMINT/CEO) 


Classified Report to the Minister 

— Role of the CSE's client relations officers and the Operational Policy Section 
in the release of personal information — March 31, 2007 (TOP SECRET/ 
COMINT/CEO) 
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ANNEX C: STATEMENT OF EXPENDITURES 2006-2007 


Standard Object Summary 
Salaries and Wages 

Transportation and Telecommunications 
Information 

Professional and Special Services 
Rentals 

Purchased Repair and Maintenance 
Materials and Supplies 

Acquisition of Machinery and Equipment 
Other Expenditures 


Total 


$594,551 
121000 
14,071 
402,620 
140,315 
4,649 
6,404 
oe: 
21186 


$1,267,612 
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ANNEX D: HISTORY OF THE OFFICE OF THE 
COMMUNICATIONS SECURITY ESTABLISHMENT 
COMMISSIONER 


The Office of the Communications Security Establishment Commissioner (OCSEC) 
was created on June 19, 1996, with the appointment of the inaugural Commissioner, 
the Honourable Claude Bisson, O.C., a former Chief Justice of Quebec, who held the 
position until June 2003. He was succeeded by the Right Honourable Antonio Lamer, 
PC., C.C., C.D., LL.D., D.U., Chief Justice of Canada (retired) for a term of three 
years. The Honourable Charles D. Gonthier, Q.C., who retired as Justice of the 
Supreme Court of Canada in 2003, was appointed as Commissioner in August 2006. 


For the first six years (from June 1996 to December 2001), the Commissioner carried 
out his duties under the authority of Orders in Council issued pursuant to Part II of the 
Inquiries Act. During this period, the Commissioner’s responsibilities were twofold: to 
review the activities of the Communications Security Establishment (CSE) to deter- 
mine whether they conformed with the laws of Canada; and to receive complaints 
about CSE’s activities. 


Following the terrorist attacks in the United States on September 11, 2001, Parliament 
adopted the omnibus Anti-Terrorism Act which came into force on December 24, 2001. 
The omnibus Act introduced amendments to the National Defence Act, by adding Part 
V.1 and creating legislative frameworks for both OCSEC and CSE. It also gave the 
Commissioner new responsibilities to review activities carried out by CSE under a 
ministerial authorization. 


The omnibus legislation also introduced the Security of Information Act, which 
replaced the Official Secrets Act. This legislation gives the Commissioner specific 
duties in the event that a person, who would otherwise be permanently bound to secre- 
cy, seeks to defend the release of classified information about CSE on the grounds that 
it is in the public interest. 


Under the Commissioner’s current mandate, which entrenched in law the original 
mandate established in 1996 as well as the additional responsibilities described above, 
the Commissioner has retained the powers of a commissioner under Part II of the 
Inquiries Act. 
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ANNEX E: ROLE AND MANDATE OF THE COMMUNICATIONS 
SECURITY ESTABLISHMENT 


The Communications Security Establishment (CSE) is Canada’s national cryptologic 
agency. Unique within Canada’s security and intelligence community, CSE employs 
code-makers and code-breakers to provide the Government of Canada with information 
technology security and foreign signals intelligence services. CSE also provides techni- 
cal and operational assistance to federal law enforcement and security agencies. 


CSE’s foreign signals intelligence products and services support government decision- 
making in the fields of national security, national intelligence and foreign policy. CSE’s 
signals intelligence activities relate exclusively to foreign intelligence and are directed by 
the Government of Canada’s intelligence priorities. 


CSE’s information technology security products and services enable its clients (other 
government departments and agencies) to effectively secure their electronic information 
systems and networks. CSE also conducts research and development on behalf of the 
Government of Canada in fields related to communications security. 


CSE has a three-part mandate under Part V.1, subsection 273.64(1) of the National 
Defence Act. These are known as the (a) (b) and (c) mandates: 


(a) to acquire and use information from the global information infrastructure for 
the purpose of providing foreign intelligence, in accordance with Government 
of Canada intelligence priorities; 

(b) to provide advice, guidance and services to help ensure the protection of elec- 
tronic information and information infrastructures of importance to the 
Government of Canada; and 

(c) to provide technical and operational assistance to federal law enforcement and 
security agencies in the performance of their lawful duties. 
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INTRODUCTION 


This is my second annual report as Communications Security 
Establishment Commissioner, and its publication occurs at the mid-point 
in my three-year term. 


The fact that I am halfway through my first 


mandate gives me pause for reflection. Like my seek assurance of 


predecessors, I seek assurance of compliance with ompliance with the spirit 
the spirit of the law, and not just the letter. In this 


regard, I am concerned with situations where lack 


_ Of the law, and not just 
_ the letter. 

of compliance with the law may arise, and I tailor ee 

my recommendations to safeguard against that possibility. If I determine 

there may not have been compliance with the law, I must of course inform 

the Minister of National Defence and the Attorney General of Canada. 


This leads me to contemplate one of my personal preoccupations—the 
role of the individual in doing the right thing. In the case of the 
Communications Security Establishment Canada (CSEC),! the people 
who are doing the work must have more than just technical ability. They 
must also have a fundamental respect for the rule of law and for 
democracy, which includes a reasonable expectation of privacy for all 
Canadians. CSEC’s organizational culture must reflect these values, and 
CSEC must develop and follow policies and procedures that flow from 
the law and the values. 


It is very clear to me that as a result of the terrorist acts of 2001, as well 
as subsequent terrorist activities, many Canadians continue to live with a 
heightened sense and level of risk, and there 1s little likelihood that these 
will diminish. This places a greater burden on people such as those 
employed at CSEC, because the government relies upon them to go 
beyond the mechanical aspects of information collection. They are called 
upon to reach for information that will support good decision making 
and thereby protect Canadians, but in a way that safeguards privacy. 


| The name was changed to Communications Security Establishment Canada effective September 27, 
2007, in order to comply with the Government of Canada’s Federal Identity Program. 
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During the past year, I may at times have been critical of certain of 
CSEC’s practices that, in my opinion, could be strengthened. I hold the 
view, however, that the striking point of the last several months has been 
the CSEC Chief’s handling of an operational issue that came to light at 
the end of 2006 that had the potential for non-compliance. The Chief 
informed me about the matter at once, and has kept me apprised on a 
regular basis of all corrective steps taken. CSEC management’s 
measured response addressed the needs of the organization, and was at 
the same time respectful of the people who serve in it, while leaving no 
doubt as regards their obligations. 


THE REVIEW ENVIRONMENT 


House of Commons Subcommittee and 
Special Senate Committee recommendations 
on the Anti-ferrorism Act 


In its Final Report presented to the House of Commons on 

March 27, 2007, the Subcommittee of the House of Commons reviewing 
the omnibus Anti-terrorism Act made a number of recommendations 
concerning CSEC and my office, dealing particularly with the legal 
ambiguities in the provisions allowing for ministerial authorizations. 
Since the Anti-terrorism Act received Royal Assent in December 2001, 
my predecessors and I have faced a persistent dilemma arising from the 
amendments this Act introduced to the National Defence Act. 
Particularly troublesome has been the lack of agreement between my 
office and CSEC concerning the legal advice provided to CSEC by the 
Department of Justice. At issue is the interpretation given to the 
provisions relating to ministerial authorizations. 


The Subcommittee’s Final Report urged government counsel and me to 
resolve the issues concerning ministerial authorizations. As well, the 
Subcommittee requested that the Government’s response to the Final 
Report indicate, to the extent possible, what the issues of disagreement 
are and how they have been resolved. Failing this, the Subcommittee 
encouraged me to provide these details in my 2007—2008 Annual Report. 
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The Government issued its response on 
July 18, 2007. It noted that “CSE is working 
with Department of Justice officials to address 


: overnment noted that 


ve amendments 


these issues, with a view to bringing forward e brought forward 


proposed legislative amendments in due “ind e course”. One year 
course.”* One year later, there appears to have later there appears to have 


been a lack of progress. In the meantime, I wish 
544 nN a lack of progress. 

to respond to the Subcommittee’s request and to mn 

describe two of my principal recommendations 


relating to ministerial authorizations. 


Proposed amendments to the National 
Defence Act 


The provision relating to ministerial authorizations issued for the sole 
purpose of obtaining foreign intelligence reads as follows: 


Ministerial authorization 


273.65 (1) The Minister may, for the sole purpose of obtaining foreign 
| intelligence, authorize the Communications Security 
Establishment in writing to intercept private 
communications in relation to an activity or class of 
activities specified in the authorization. 


Conditions for authorization 


(2) The Minister may only issue an authorization under 
subsection (1) if satisfied that 
(a) the interception will be directed at foreign entities 
located outside Canada; 
(b) the information to be obtained could not reasonably be 
obtained by other means; 


? Response of the Government of Canada to the Final Report of the House of Commons 
Standing Committee on Public Safety and National Security Subcommittee on the review of the 
Anti-terrorism Act, p. 20. 
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(c) the expected foreign intelligence value of the 
information that would be derived from the interception 
justifies it; and 

(d) satisfactory measures are in place to protect the privacy 
of Canadians and to ensure that private communications 
will only be used or retained if they are essential to 
international affairs, defence or security. 


ee 


My first principal recommendation concerns the term activity or class of 
activities as it relates to CSEC and to the Commissioner. My 
predecessors and I have long held the view that a plain reading of the 
National Defence Act supports the interpretation that the interception 
authorized by the Minister is that of a private communication in relation 
to an activity or class of activities which is targeted or the object of 
inquiry, and not to a method of collection as contended by CSEC. 
Therefore, an important amendment would be to clarify the meaning of 
the term activity or class of activities. 


My second principal recommendation is to define the terms intercept 
and interception, or to provide a reference to the existing definition of 
intercept in the Criminal Code. At present, these terms are not defined in 
the National Defence Act. However, they have both legal and operational 
significance for CSEC. 


In the absence of definitions that are universally understood and 
consistently applied, it is difficult for me to interpret CSEC’s legislated 
authority and to review how it has been applied. 


The Special Senate Committee on the Anti-terrorism Act also made 
recommendations relating to ministerial authorizations. Notably, the 
Committee recommended “that subsections 273.65(2) and (4) of the 
National Defence Act be amended to clarify whether the facts and 
opinions, which are necessary to satisfy the Minister of National 
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Defence that all of the preconditions for issuing a written authorization 
to intercept private communications have been met, should be based 
on reasonable belief or reasonable suspicion”. Clarifying in law the 
standard to be used remains an issue of interest to my office, and I 
continue to support making such an amendment to the National 
Defence Act. 


In addition, I have made other recommendations to officials at CSEC 
and at the Department of Justice for amendments that I think would be 
worthwhile to enact. 


In response to another recommendation of the House of Commons’ 
Subcommittee, the Government indicated that it did not intend to modify 
the National Defence Act to specify that my office should review 
interception activities for compliance with the Canadian Charter of 
Rights and Freedoms and the Privacy Act. As I pointed out in last year’s 
Annual Report, my office’s review methodology has always included an 
examination of compliance with all relevant laws, including the Charter 
and the Privacy Act. 


The Subcommittee’s Final Report also recommended that the 
Government proceed with legislation to establish a National Security 
Committee of Parliamentarians responsible for the review of national 
security matters, and that this Committee be called upon to conduct a 
further comprehensive review of the Anti-terrorism Act after a fixed 
period. The Government responded that it has not determined if this is 
the best way to proceed. However, it went on to note that it “will 
propose an approach to national security review that will meet the basic 
objectives set out in the second report of the Commission of Inquiry into 
the Actions of Canadian Officials in Relation to Maher Arar and is 
considering options for an enhanced role for Parliamentarians as a key 


3 Special Senate Committee on the Anti-terrorism Act, F undamental Justice in Extraordinary Times: 
Main Report of the Special Senate Committee on the Anti-terrorism Act, February 2007, 
recommendation 18, p.78. 
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part of these proposals for an improved national security review 
framework.” As I commented in my report last year, I concur with my 
predecessor’s position that welcomes “the prospect of more active 
parliamentary review of national security activities,” while also noting 
“challenges such as the composition of the committee and its access to 


classified information and documents.” 


lacobucci Internal Inquiry and the Major 
Commission of Inquiry | 


The Honourable Frank Iacobucci is in the process of conducting an 
internal inquiry into the actions of Canadian officials in relation to 
Abdullah Almalki, Ahmad Abou-Elmaati and Muayyed Nureddin. He is 
to determine, amongst other matters, whether the detention or any 
mistreatment of these individuals in Syria or Egypt resulted, directly or 
indirectly, from actions of Canadian officials, particularly in relation to 
the sharing of information with foreign countries and, if so, whether 
those actions were deficient in the circumstances. 


The Honourable John Major is conducting an inquiry into the 
investigation of the bombing of Air India Flight 182. In particular, he is to 
determine whether any changes in practice or legislation are required to 
prevent the recurrence of similar problems of cooperation between the 
Canadian Security Intelligence Service (CSIS) and the Royal Canadian 
Mounted Police (RCMP) in the investigation of terrorism offences, and to 
recommend how government should go about establishing a reliable and 
workable relationship between security intelligence and law enforcement 
agencies regarding the use of intelligence as evidence in a criminal trial. 


I have an interest in the sharing of information about Canadians, 
particularly when that information is to be shared outside Canada. This is 
an area that my office continues to examine. In this context, the outcomes 
of the Iacobucci and Major Commissions may have an impact on security 
and intelligence agencies, as well as review agencies, including my office. 


4 Supra, note 2 at p. 25. 
* Communications Security Establishment Commissioner, Annual Report 2006-2007, p. 8. 
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THE YEAR IN REVIEW 


Last year, I referred to the independent management review of the 
operations of my office, and to recommendations to improve our 
methodology. These matters have been thoroughly examined, and 
changes have been incorporated in new operational policies and 
procedures. My office has been implementing these changes in the 
conduct of reviews. One of the most notable is a new approach that 
involves examining processes which are common to several different 
CSEC activities. As a result, the review function is expected to be more 


effective in at least two ways: first, by avoiding a certain amount of 
duplication; and second, by creating a greater and readier understanding 
of underlying activities at the core of CSEC’s mandate. CSEC has been 
kept informed throughout the process of implementing these changes, 
and specific issues of methodology that have a direct impact on that 
organization and on our working relationship have been discussed. 


At my request, CSEC provided several briefings to my staff during the 


past year. Some of the briefings have become annual occurrences, such 
as those related to policy developments and updates, and also to the 


implementation of a new information management system. Other 
briefings have dealt with cyber-threat activities and with certain aspects 
of cooperation with CSIS. As is standard practice, and at our request, 
CSEC also provided briefings at the beginning of most reviews initiated 


during the year. 


Workplan 


A three-year workplan guides the activities of my office. It is an integral 
component of the review process as well as being a focal point in the 
relationship between my office and CSEC. It is updated on a regular 
basis. Each update involves a re-assessment of the priority of planned 
and potential review projects and incorporates new information that may 
have come to our attention. For example, a review that has just been 
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completed may identify an area outside the scope of that review but 
which I believe needs to be examined further, perhaps to assess 
compliance with the law or to ensure the protection of the privacy of 
Canadians. In my report last year, I listed other criteria that contribute to 
determining what areas or topics will be included in the workplan. I 
must, however, always weigh what is reviewed against what is not, and 
be satisfied to the extent possible that those areas of greater risk to 
compliance with the law or to privacy are being examined. 


CSEC is consulted on the workplan. There are several reasons for this. 
This is a standard practice in review to ensure that no one area of the 
organization is unduly burdened. There must be balance between my 
review mandate and CSEC’s operational requirements mandated by the 
government. Another significant reason is that there is a need to ensure 
that the scheduling and scope of review projects is reasonable and can be 
carried out in a timely manner, taking into consideration the resources 
and mandates of both organizations. 


An important initiative agreed upon by both CSEC and my office was to 
organize a roundtable discussion focussed on the working relationship. 
The objective was to optimize the review process, which as well means 
minimizing any adverse impact on the activities of CSEC. The meeting 
reviewed the business processes of both groups, identified points where 
improvement was desirable and proposed how to achieve those 
improvements. A number of issues related to the workplan were also 
identified and have been implemented. There was general agreement 
that this type of meeting was useful and served the interests of both 
organizations to keep open the lines of communication and to ensure 
that review works as intended. 
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Reviews undertaken of the activities of CSEC 


My general review mandate is set out in paragraph 273.63(2)(a) of the 
National Defence Act.® Under subsection 273.65(8) of the Act, I also 
have an obligation to review and report to the Minister as to whether the 
activities carried out under a ministerial authorization are authorized. 


Ministerial authorizations for foreign intelligence collection are issued 
under the authority of subsection 273.65(1) of the National Defence Act, 
whereas ministerial authorizations for information technology security 
activities are issued under subsection 273.65(3) of the Act. My reviews 
of CSEC’s activities conducted under ministerial authorizations are 
undertaken after the ministerial authorization has expired. 


As I noted in my Annual Report last year: “The characteristics of 
contemporary communications technology mean that the interception of 
communications by CSE, directed at foreign entities outside Canada, 
runs the inherent risk of acquiring the private communications of 
Canadians. It is for this reason that a ministerial authorization is sought 
for this collection.”’ 


The ministerial authorization provisions do not allow CSEC to target 
Canadian communications. However, “for the sole purpose of obtaining 
foreign intelligence”®, the Minister may authorize the interception of 
private communications of Canadians or persons in Canada as long as 
the interception was the result of CSEC’s targeting a foreign entity 
located outside Canada. Ministerial authorizations for information 
technology security activities also authorize the interception of private 
communications that may be incidentally obtained by CSEC while 
protecting the systems and networks of a federal government 
department or agency. 


6 Please see Annex A for the text of the relevant sections of the National Defence Act. 
7 Supra, note 5 at p. 18. 
8 Subsection 273.65(1) of the National Defence Act. 
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Further, when collecting foreign intelligence, CSEC may also incidentally 
acquire information about Canadians. This information may only be 
retained if it is assessed as essential to the understanding of the foreign 
intelligence, and it may be included in foreign intelligence reporting if it 
is suppressed (i.e., replaced by a generic reference such as “a Canadian 
person”). When receiving a subsequent request for disclosure of the 
details of the suppressed information, CSEC requires federal government 
departments and agencies to explain their authority to collect this 
information under their own respective mandates and to provide an 
operational justification of their need to know this information. If these 
conditions are met, CSEC may release the suppressed information. This 
year, two of my reports included detailed reviews of such releases. 


During 2007-2008, my office submitted to the Minister five classified 
reports based on reviews completed during the year. Two of the reviews 
dealt with CSEC’s activities conducted under ministerial authorization; 
one of these pertained to foreign intelligence collection, while the other 
concerned information technology security. The other three reviews 
were conducted under my general mandate, to assess whether CSEC’s 
activities were in compliance with the law, and the extent to which it 
protected the privacy of Canadians in carrying out the activities. 


Methodology 


Prior to beginning a review, my office provides CSEC with terms of 
reference that set out the objective, scope, criteria, a summary of the 
approach to be taken, and a timetable for the review. In conducting a 
review, OCSEC reviewers employ standard fact-finding tools and 
techniques to gather evidence, including examination of all relevant 
written and electronic records, and the associated authorities, policies 
and procedures. Reviewers also conduct extensive testing and sampling. 
Interviews are held with management and other personnel involved in 
the activities under review. Officials from other federal government 
departments and agencies may also be interviewed. In addition, legal 
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opinions and advice are examined. CSEC provides briefs and 
demonstrations of activities as well as answers to written questions. At 
the conclusion of the review process, reviewers meet with CSEC 
officials prior to finalizing their report. The purpose of this meeting 1s to 
outline review findings and conclusions. 


Overview of 2007-2008 findings 


Although the five reviews reported on this year differed in subject, there 
were recurring themes, some of which are noted below. Overall, I am 
able to report that the activities of CSEC examined during the year 
complied with the law. 


Interpretation of ministerial authorizations 

As noted earlier, CSEC and my office are still on opposite pages as 
regards the interpretation of the provisions of the National Defence Act 
relating to ministerial authorizations. However, pending legislative 
amendments, I have continued my predecessor’s practice of reviewing and 
reporting on whether CSEC’s activities conducted under ministerial 
authorization comply with the Act as it has been interpreted by the 
Department of Justice. On this basis, I am able to report that the two 
reviews of activities conducted under ministerial authorizations complied 
with the National Defence Act as interpreted by the Department of Justice. 


Information management 
The theme of weak document and information management has been a 
consistent one over time. Good information management ensures that all 
relevant information and documentation is entered into the corporate 
record. However, as I and my predecessors have 


noted in previous reports, inadequate or missing Inadequate information 


information in CSEC’s corporate records can can impair my ability to 


impair my ability to conduct reviews and to sonduct reviews. 
determine whether CSEC’s activities comply ale 
with the law. This has left me, in some instances, in a position of 


providing only a negative assurance to the Minister that I have no 
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a 
evidence of non-compliance with the law, rather than providing positive 
assurance, supported by evidence of compliance. CSEC is well aware of 
my concerns in this regard, is committed to addressing this issue, and 1s 
making progress in implementing a corporate records management 
system. CSEC is keeping me informed of its efforts. Future reviews will 
continue to seek documentation that demonstrates compliance with 
authorities, provides a record of all activities conducted, and confirms 
that supervisors are monitoring the performance of their staff. 


Interpretation of foreign intelligence mandate 

In last year’s Annual Report, I noted that one of the issues raised by my 
review of CSEC’s foreign intelligence collection in support of the 
RCMP was “whether [the foreign intelligence part of CSEC’s mandate] 
was the appropriate authority in all instances for CSE to provide 
intelligence support to the RCMP in the pursuit of its domestic criminal 
investigations.”? Pending a re-examination of the legal issues raised, | 
decided that no assessment would be made of the lawfulness of CSEC’s 
activities in support of the RCMP under the foreign intelligence part of 
CSEC’s mandate as it is currently interpreted and applied. This issue 
remained unresolved as of March 31, 2008. My review of CSEC’s 
support to CSIS, which is reported on below, raised similar issues. As I 
note in this instance, and unlike the matter of ministerial authorizations, 
I am in agreement with the advice that the Department of Justice has 
provided to CSEC. However, in certain cases, I question which part of 
CSEC’s mandate should be used as the proper authority for conducting 
these activities. Discussions on these matters are ongoing. 


° Supra, note 5 at p. 13. 
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2007-2008 REVIEW HIGHLIGHTS 


Review of CSEC signals intelligence collection 
activities conducted under ministerial 
authorizations (Phase Il) 


Background 

This report is the second and final phase of a review of certain foreign 
intelligence collection activities conducted under three ministerial 
authorizations that were in effect from March 2004 to December 2006. 
The first phase, which I reported on in last year’s Annual Report, 
established an understanding of this foreign intelligence collection. It 
also examined the authorities, policies, procedures and management 
framework put in place to oversee the activities, and established the 
review criteria for this second phase. 


The objective of this second phase was to assess and verify whether 
the activities that were authorized under the ministerial authorizations 
complied with the law as well as with the expectations set out in a 
ministerial directive relating to these activities. 


Findings 

With respect to the conditions imposed by the ministerial authorizations, 
which are articulated in subsection 273.65(2) of the National Defence 
Act, and the conditions imposed by the Minister as part of the 
authorization process, I found no evidence of non-compliance with the 
law. For a number of conditions, however, a lack of information and 
documentation did not allow my office to verify compliance. The review 
also found that, in some instances, CSEC had not complied with 
expectations set out in the ministerial directive, and I have so advised 
the Minister. 
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Operational policies were found to be in place and to provide direction to 
CSEC in the protection of the privacy of Canadians. No information was 
found to indicate that the actions of CSEC staff were in contravention 

of the operational policies. However, the absence and incompleteness of 
recorded information limits me to providing only a negative assurance 

to the Minister. That is to say that I have found no evidence of non- 
compliance with the law. 


Review of information technology security 
activities at a government department 


Background 

This review examined information technology security activities 
conducted by CSEC under ministerial authorization in 2004—2005 at a 
government department. The objective was to assess compliance with 
the law and with the provisions of the ministerial authorization. 


The National Defence Act mandates CSEC to help protect the 
Government of Canada’s computer systems and networks by analyzing 
the vulnerability of selected computing and telecommunications systems 
and by providing information technology security advice and services to 
government departments and agencies. 


CSEC’s information technology security activities may result in the 
inadvertent interception of private communications of Canadians or 
personal information about a Canadian. For this reason, subsection 
273.65(3) of the National Defence Act provides that: 


The Minister may, for the sole purpose of protecting the 
computer systems or networks of the Government of Canada 
from mischief, unauthorized use or interference, in the 
circumstances specified in paragraph 184(2)(c) of the Criminal 
Code, authorize the Communications Security Establishment in 
writing to intercept private communications in relation to an 
activity or class of activities specified in the authorization. 
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The CSEC Chief is responsible for seeking authorization on behalf of 
the department or agency requesting the activity to be covered. This 
ministerial authorization enables CSEC to undertake a complete security 
assessment of a department’s networks. 


Findings 

The review found that CSEC’s information technology security 
activities at the department were in compliance with the law and with 
the ministerial authorization. The process by which CSEC acquired the 
ministerial authorization was in accordance with the requirements of 
the National Defence Act and the processes outlined in CSEC’s related 
policies. It was also determined that the five conditions set out in 
subsection 273.65(4) of the Act were complied with satisfactorily. 
Measures were in place to protect the privacy of Canadians, and 
CSEC’s use and retention of personal information about Canadians 
was found to comply with the law and CSEC policy. 


Review of CSEC’s activities carried out under a 
ministerial directive 


Background 

This review focused on certain activities undertaken by CSEC under a 
ministerial directive and, in the context of ministerial authorizations, in 
support of its foreign intelligence mandate articulated in paragraph 
273.64(1)(a) of the National Defence Act for the period of April 1, 2005 
to March 31, 2006. 


Technology and telecommunications networks continue to increase in 
complexity. In order to fulfill its legislative mandate, CSEC conducts 
activities for the purposes of understanding the global information 
infrastructure and of locating foreign intelligence, in accordance with 
the intelligence priorities of the Government of Canada. 
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The objective of this review was to increase my office’s knowledge of 
these activities and the authorities under which the activities are 
conducted. The review assessed CSEC’s compliance with the ministerial 
directive and with the laws of Canada, including the National Defence 
Act, the Charter, and the Privacy Act, which governs the collection, 

use and disclosure of personal information. The review also assessed 
whether the activities conformed to CSEC’s policies and procedures. 


Findings 

This was my office’s first examination of this activity, as governed by the 
ministerial directive. I am satisfied that CSEC takes measures to protect 
the privacy of Canadians in the use and retention of data obtained from 
this activity. However, I made a number of recommendations, as follows. 


First, I believe that CSEC should re-examine its practice that only those 
private communications recognized by certain staff be accounted for. 
I recommended that other staff that observe and handle private 


: communications should also be responsible 
Staff that observe and handle 


for accounting for them. Second, CSEC should 


private communications re-assess which part of its legislative authority 
should be responsible for ought to be used to conduct certain of these 
. counting for them activities, particularly those involving 


information provided by federal law 
enforcement and security agencies. Finally, I also believe that CSEC 
should augment its policy and procedures in order to better guide and 
support these activities. 


My office has since been advised that CSEC is re-examining these 
activities and associated policies and procedures. I support CSEC’s 
initiative, and will continue to monitor the issues raised during this review. 
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Review of CSEC’s counterterrorism activities 


Background 
This review examined the lawfulness of CSEC’s counter-terrorism 
activities in the period from April 1 to July 31, 2005. 


In early October 2001, CSEC centralized foreign intelligence efforts as 
they relate to threats from international terrorism. The activities involve 
research and analysis of foreign intelligence data in order to identify 
terrorist targets and their operational and support networks. The 
information may be shared with federal government departments and 
agencies involved in intelligence and security-related matters, as well as 
with Canada’s principal intelligence partners. 


The main objectives of the review were to examine data collection and 
reports from the review period to verify that the information was collected, 
used and retained in compliance with the law, and to identify and report on 
any other issue of concern that might impact on the ability of CSEC to 
conduct its activities lawfully and to safeguard the privacy of Canadians. 


Findings 

This review found that the activities conducted were in compliance with 
the law and with CSEC policy. Personnel who were interviewed during 
the course of this review were knowledgeable about the authorities 
governing their work. The report makes two recommendations. One 
would enhance accountability regarding linkages between CSEC 
reporting and the intelligence priorities of the Government of Canada, 
and the other would enhance accountability for the use and retention of 
private communications and information about Canadians. 
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Review of CSEC’s support to CSIS 


Background 

The objective of this review was to assess the lawfulness of CSEC’s 
activities in providing support to the Canadian Security Intelligence 
Service (CSIS) under CSEC’s foreign intelligence mandate in the period 
from April 1, 2004 to March 31, 2005 and a sampling from November to 
December 2006. 


CSEC provides regular foreign intelligence reporting to CSIS. Most of 
this reporting addresses general areas of interest that complement and 
support CSIS’ own mandated responsibilities. CSEC also receives and 
responds to specific CSIS requests for intelligence-related information, 
provided that the requirement is consistent with documented 
Government of Canada intelligence priorities. A final aspect of CSEC’s 
support to CSIS is that it responds to requests for the release of Canadian 
identities that have been suppressed in foreign intelligence reporting. 
Upon receipt of a formal request, CSEC must be satisfied with the 
justification and lawful authority for requiring the information. 


Findings 

Overall, I am of the opinion that CSEC acted within its mandate in 
conducting activities in support of CSIS. I am in accord with the advice 
and guidance provided by the Department of Justice to CSEC respecting 
this support. However, in some cases, I question which part of CSEC’s 
mandate should be used as the proper authority for conducting these 
activities and I have recommended that CSEC re-examine this matter. As 
of March 31, 2008, this was the subject of ongoing discussions between 
my officials and CSEC. 


In addition, my office identified concerns respecting requests for the 
release of suppressed information, and respecting the CSIS-CSE 
Memorandum of Understanding of 1990 that guides the agencies’ 
cooperation. Many of my findings reinforced those of two previous 
reviews of CSEC’s foreign intelligence collection in support of the 
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RCMP and of the roles of CSEC’s client relations officers and 
Operational Policy Section in the release of personal information, both 
of which are described in my 2006—2007 Annual Report. 


I am pleased to note that since the period of review, CSEC continues to 
review its internal processes, policies and procedures, in order to make 
improvements in areas where deficiencies have 1m 
Pe er aah ed _ CSEC continues fo make 
_ improvements in areas 

I have, however, recommended that CSEC re-visit | where deficiencies have 
the Memorandum Be Peseta ie between been identified. 
CSIS and CSEC which is out of date and does not | 


reflect current arrangements or practices between the two agencies. Given 


the international threat environment, it is my view that cooperation 
between security and intelligence agencies must be continually examined 
and the frameworks for cooperation kept up to date. 


Reviews underway and planned 


My office has several reviews underway that I will be reporting on to 
the Minister in the coming year and will include in my next Annual 
Report. The subjects of these reviews include: activities conducted by 
CSEC under several foreign intelligence ministerial authorizations, the 
disclosure of information about Canadians to federal government 
departments and agencies; an examination of certain common practices 
of CSEC related to its mandated activities, and a comprehensive study 
of its information technology security activities. Some reviews that will 
begin in the next fiscal year will carry through to 2009-2010. Last year 
I indicated that I would be reporting on CSEC’s use of technology to 
protect the privacy of Canadians. At fiscal year-end, this review was 
being finalized, and therefore it will be reported on in next year’s 
Annual Report. 
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Complaints about CSEC activities 


My mandate includes undertaking any investigation I deem necessary 
in response to a complaint. During the 2007—2008 fiscal year my office 
received no complaints that warranted formal investigation. 


Duties under the Security of Information Act 


I have a duty under the Security of Information Act to receive 
information from persons who are permanently bound to secrecy and 
seek to defend the release of classified information about CSEC on the 
grounds that it is in the public interest. No such matters were reported to 
my office in the 2007—2008 fiscal year. 


THE COMMISSIONER'S OFFICE 


I continue to be supported in my work by a full-time staff of eight 
people, together with a number of subject matter experts who make 
themselves available, as required, under contract. 


Keeping sufficiently current with technology to support my review of 
CSEC’s activities is always a challenge. It was facilitated this year by 
CSEC itself. In the fall of 2007, CSEC opened its doors to members 
of my staff who attended two courses for CSEC employees, one 
respecting information technology security, and another course 
covering foreign intelligence. 


In May 2007, I addressed a meeting of the Advisory Council on | 
National Security that was held in Ottawa. The Advisory Council was 
created in April 2004 as a feature of the National Security Policy. It 1s 
made up of individuals from outside the government whose function 

is to provide advice on security matters. 
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Also in May, my office hosted a meeting of the Review Agencies Forum, 
which brings together the staff members of the Security Intelligence 
Review Committee, the Office of the Inspector General of the Canadian 
Security Intelligence Service, the Commission for Public Complaints 
against the Royal Canadian Mounted Police and my own office. The 
Forum provides an opportunity for review analysts to compare best 
practices and discuss issues of mutual interest and concern. In this regard, 
my office’s review methodology initiative was discussed at length. 


In June 2007, I had the pleasure of introducing U.S. Supreme Court 
Justice Antonin Scalia at the Jnternational Conference on the 
Administration of Justice and National Security in Democracies, held 
in Ottawa. The Conference, which was jointly sponsored by the Federal 
Court of Canada and the Canadian Centre of Intelligence and Security 
Studies at Carleton University, also provided me with an opportunity 

to renew my contacts with colleagues from other countries, some of 
whom I had met at the last International Intelligence Review Agencies 
Conference (RAC) in South Africa in October 2006. 


Also in June, I was represented by the Executive Director at an 
international conference on Accountability of Intelligence and Security 
Agencies and Human Rights, held in The Hague under the auspices of 
the Dutch Review Committee on the Intelligence and Security Services 
and the Faculty of Law of Radboud University, Nijmegen. In September, 
I was represented by the Director of Operations at the annual conference 
of the Canadian Association for Security and Intelligence Studies in 
Calgary, where participants explored the many challenges facing the 
security and intelligence community. 


Also in September, I attended a two-day conference entitled Protecting 
Security and Human Rights: The Case for Migration in Canada and 
sponsored by the Institute for Research in Public Policy. 


All these initiatives demonstrate increasing interest, in Canada and 
abroad, in security and intelligence matters and their many dimensions. 
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Since its creation in 1996 by Order in Council pursuant to Part IT of the 
Inquiries Act, the Office of the CSE Commissioner has been funded by 
the Department of National Defence, but has received administrative and 
other support from the Privy Council Office. 


Over the fall months, a decision was taken that the long-standing 
relationship with the Privy Council Office would be severed, and that the 
administrative and other support activities for my office would be taken 
over by National Defence. I view this change in a positive light. I would 
be remiss, however, if I failed to take note of the outstanding help and 
support provided by the staff of the Privy Council Office over the last 
twelve years. Thank you from all of us. 


In the interest of providing information about OCSEC’s work, my office 
hosts a website (www.ocsec-bccst.gc.ca) that describes our mandate 

and activities. In fiscal year 2007—2008, there were over 98,000 visits 

to the site, including visitors from approximately 40 countries outside 
North America. 


In 2007-2008, my office’s expenditures were $1,220,999, which was 
well within budget for the period. Annex C to this report provides a 
summary of 2007—2008 expenditures. 


A TRIBUTE 


On November 24, 2007, the Right Honourable Antonio Lamer, my 
predecessor as CSE Commissioner, died at age 74. Antonio Lamer was a 
renowned lawyer and jurist. He was appointed to the Supreme Court of 
Canada in 1980, and was named Chief Justice in 1990, a position that he 
occupied until his retirement in 2000. 


For my part, he was my colleague on the bench for over 11 years, and 


my long-standing friend. His contribution to Canadian jurisprudence was 
outstanding, exceeded only by his love of Canada. He is missed. 
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ANNEX A: MANDATE OF THE COMMUNICATIONS SECURITY 
ESTABLISHMENT COMMISSIONER 


National Defence Act — Part V.1 


273.63 (1) The Governor in Council may appoint a supernumerary judge or a retired 
judge of a superior court as Commissioner of the Communications Security 


Establishment to hold office, during good behaviour, for a term of not more 
than five years. 


(2) The duties of the Commissioner are 


(a) to review the activities of the Establishment to ensure that they are in 
compliance with the law; 


(b) in response to a complaint, to undertake any investigation that the 
Commissioner considers necessary; and 


(c) to inform the Minister and the Attorney General of Canada of any 
activity of the Establishment that the Commissioner believes may not be 
in compliance with the law. 


(3) The Commissioner shall, within 90 days after the end of each fiscal year, 
submit an annual report to the Minister on the Commissioner’s activities and 
findings, and the Minister shall cause a copy of the report to be laid before 
each House of Parliament on any of the first 15 days on which that House is 
sitting after the Minister receives the report. 


(4) In carrying out his or her duties, the Commissioner has all the powers of a 
commissioner under Part II of the /nquiries Act. 


(5) The Commissioner may engage the services of such legal counsel, technical 
advisers and assistants as the Commissioner considers necessary for the 
proper performance of his or her duties and, with the approval of the Treasury 
Board, may fix and pay their remuneration and expenses. 
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(6) The Commissioner shall carry out such duties and functions as are assigned 
to the Commissioner by this Part or any other Act of Parliament, and may 
carry out or engage in such other related assignments or activities as may be 
authorized by the Governor in Council. 


(7) The Commissioner of the Communications Security Establishment holding 
office immediately before the coming into force of this section shall continue 
in office for the remainder of the term for which he or she was appointed. 


[...] 


273.65 (8) The Commissioner of the Communications Security Establishment shall 
review activities carried out under an authorization issued under this section 
to ensure that they are authorized and report annually to the Minister on 
the review. 


Security of Information Act 


15. (1) No person is guilty of an offence under section 13 or 14 if the person establishes 
that he or she acted in the public interest. [...] 


(5) A judge or court may decide whether the public interest in the disclosure 
outweighs the public interest in non-disclosure only if the person has complied 
with the following: [...] 


(b) the person has, if he or she has not received a response from the deputy head 
or the Deputy Attorney General of Canada, as the case may be, within a 
reasonable time, brought his or her concern to, and provided all relevant 
information in the person’s possession to, [...] 


(ii) the Communications Security Establishment Commissioner, if the 
person’s concern relates to an alleged offence that has been, is being or is 
about to be committed by a member of the Communications Security 
Establishment, in the purported performance of that person’s duties and 
functions of service for, or on behalf of, the Communications Security 
Establishment, and he or she has not received a response from the 
Communications Security Establishment Commissioner within a 
reasonable time. 
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ANNEX B: CLASSIFIED REPORTS TO THE MINISTER, 1996-2008 
1. Principal vs. agent status — March 3, 1997 (TOP SECRET) 

2. Operational policies with lawfulness implications — February 6, 1998 (SECRET) 
3. CSE’s activities under *** — March 5, 1998 (TOP SECRET Codeword/CEO) 

4. Internal investigations and complaints — March 10, 1998 (SECRET) 

5. CSE’s activities under *** — December 10, 1998 (TOP SECRET/CEO) 


6. On controlling communications security (COMSEC) material — May 6, 1999 
(TOP SECRET) 


7. How we test (A classified report on the testing of CSE’s signals intelligence 
collection and holding practices, and an assessment of the organization’s efforts to 
safeguard the privacy of Canadians) — June 14, 1999 (TOP SECRET 
Codeword/CEO) 


8. A study of the *** collection program — November 19, 1999 (TOP SECRET 
Codeword/CEO) 


9. On *** — December 8, 1999 (TOP SECRET/COMINT) 


10. A study of CSE’s *** reporting process — an overview (Phase [) 
— December 8, 1999 (SECRET/CEO) 


11. A study of selection and *** — an overview — May 10, 2000 (TOP SECRET/CEO) 


12. CSE’s operational support activities under *** — follow-up — May 10, 2000 
(TOP SECRET/CEO) 


13. Internal investigations and complaints — follow-up — May 10, 2000 (SECRET) 


14. On findings of an external review of CSE’s ITS program — June 15, 2000 
(SECRET) 


15. CSE’s policy system review — September 13, 2000 (TOP SECRET/CEO) 
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16. Astudy of the *** reporting process — *** (Phase II) — April 6, 2001 
(SECRET/CEO) 


17. A study of the *** reporting process — *** (Phase IIT) — April 6, 2001 
(SECRET/CEO) 


18. CSE’s participation *** — August 20, 2001 (TOP SECRET/CEO) 


19. CSE’s support to ***, as authorized by *** and code-named *** — August 20, 2001 
(TOP SECRET/CEO) 


20. A study of the formal agreements in place between CSE and various external 
parties in respect of CSE’s Information Technology Security (ITS) 
— August 21, 2002 (SECRET) 


21. CSE’s support to ***, as authorized by *** and code-named *** 
— November 13, 2002 (TOP SECRET/CEO) 


22. CSE’s *** activities carried out under the *** 2002 *** Ministerial authorization 
— November 27, 2002 (TOP SECRET/CEO) 


23. Lexicon of CSE definitions — March 26, 2003 (TOP SECRET) 


24. CSE’s activities pursuant to *** Ministerial authorizations including *** 
— May 20, 2003 (SECRET) 


25. CSE’s support to ***, as authorized by *** and code-named *** — Part I 
— November 6, 2003 (TOP SECRET/COMINT/CEO) 


26. CSE’s support to ***, as authorized by *** and code-named *** — Part Il 
— March 15, 2004 (TOP SECRET/COMINT/CEO) 


27. Areview of CSE’s activities conducted under *** Ministerial authorization 
— March 19, 2004 (SECRET/CEO) 


28. Internal investigations and complaints — follow-up — March 25, 2004 
(TOP SECRET/CEO) 
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A review of CSE’s activities conducted under 2002 *** Ministerial authorization 
— April 19, 2004 (SECRET/CEO) 


Review of CSE *** operations under Ministerial authorization — June 1, 2004 
(TOP SECRET/COMINT) 


CSE’s support to *** — January 7, 2005 (TOP SECRET/COMINT/CEO) 


External review of CSE’s *** activities conducted under Ministerial authorization 
— February 28, 2005 (TOP SECRET/COMINT/CEO) 


A study of the *** collection program — March 15, 2005 (TOP SECRET/ 
COMINT/CEO) 


Report on the activities of CSE’s *** — June 22, 2005 (TOP SECRET) 


Interim report on CSE’s *** operations conducted under Ministerial authorization 
— March 2, 2006 (TOP SECRET/COMINT) 


External review of CSE *** activities conducted under Ministerial authorization 
— March 29, 2006 (TOP SECRET/CEO) 


Review of CSE’s foreign intelligence collection in support of the RCMP (Phase IT) 
— June 16, 2006 (TOP SECRET/COMINT/CEO) 


Review of information technology security activities at a government department 
under ministerial authorization — December 18, 2006 (TOP SECRET) 


Review of CSE signals intelligence collection activities conducted under 
ministerial authorizations (Phase I) — February 20, 2007 (TOP SECRET/ 
COMINT/CEO) 


Role of the CSE's client relations officers and the Operational Policy Section 
in the release of personal information — March 31, 2007 (TOP SECRET/ 
COMINT/CEO) 


Review of information technology security activities at a government department 
under ministerial authorization — July 20, 2007 (TOP SECRET) 
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42. Review of CSEC’s counter-terrorism activities — October 16, 2007 (TOP SECRET/ 
COMINT/CEO) 


43. Review of CSE’s activities carried out under a ministerial directive — January 9, 2008 
(TOP SECRET/COMINT/CEO) 


44. Review of CSEC’s support to CSIS — January 16, 2008 (TOP SECRET/ 
COMINT/CEO) 


45. Review of CSEC signals intelligence collection activities conducted under 
ministerial authorizations (Phase II) — March 28, 2008 (TOP SECRET/ 
COMINT/CEO) 
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ANNEX C: STATEMENT OF EXPENDITURES, 2007-2008 


Standard Object Summary 
Salaries and Wages 

Transportation and Telecommunications 
Information 

Professional and Special Services 
Rentals 

Purchased Repair and Maintenance 
Materials and Supplies 

Acquisition of Machinery and Equipment 
Other Expenditures 


Total 


112,195 


37,431 


PARIS, 


257,488 


151,894 


3,538 


8,652 


23208 


4,364 


$1,220,999 
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ANNEX D: HISTORY OF THE OFFICE OF THE 
COMMUNICATIONS SECURITY ESTABLISHMENT 
COMMISSIONER (OCSEC) 


The Office of the Communications Security Establishment Commissioner (OCSEC) 
was created on June 19, 1996, with the appointment of the inaugural Commissioner, the 
Honourable Claude Bisson, O.C., a former Chief Justice of Québec, who held the 
position until June 2003. He was succeeded by the Right Honourable Antonio Lamer, 
P.C., C.C., C.D., LL.D., D.U., Chief Justice of Canada (retired) for a term of three years. 
The Honourable Charles D. Gonthier, C.C., Q.C., who retired as Justice of the Supreme 
Court of Canada in 2003, was appointed as Commissioner in August 2006. 


For the first six years (from June 1996 to December 2001), the Commissioner carried 
out his duties under the authority of Orders in Council issued pursuant to Part IT of the 
Inquiries Act. During this period, the Commissioner’s responsibilities were twofold: to 
review the activities of the Communications Security Establishment Canada (CSEC) to 
determine whether they conformed with the laws of Canada; and to receive complaints 
about CSEC’s activities. 


Following the terrorist attacks in the United States on September 11, 2001, Parliament 
adopted the omnibus Anti-terrorism Act which came into force on December 24, 2001. 
The omnibus Act introduced amendments to the National Defence Act, by adding Part 
V.1 and creating legislative frameworks for both OCSEC and CSEC. It also gave the 
Commissioner new responsibilities to review activities carried out by CSEC under a 
ministerial authorization. 


The omnibus legislation also introduced the Security of Information Act, which replaced 
the Official Secrets Act. This legislation gives the Commissioner specific duties in the 
event that a person, who would otherwise be permanently bound to secrecy, seeks to 
defend the release of classified information about CSEC on the grounds that it is in the 
public interest. 


Under the Commissioner’s current mandate, which entrenched in law the original mandate 
established in 1996 as well as the additional responsibilities described above, the 
Commissioner has retained the powers of a commissioner under Part II of the /nquiries Act. 
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ANNEX E: ROLE AND MANDATE OF THE COMMUNICATIONS 
SECURITY ESTABLISHMENT CANADA (CSEC) 


The Communications Security Establishment Canada (CSEC) is Canada’s national 
cryptologic agency. Unique within Canada’s security and intelligence community, CSEC 
employs code-makers and code-breakers to provide the Government of Canada with 
information technology security and foreign intelligence services. CSEC also provides 
technical and operational assistance to federal law enforcement and security agencies. 


CSEC’s foreign intelligence products and services support government decision-making 
in the fields of national security, national intelligence and foreign policy. CSEC’s signals 
intelligence activities relate exclusively to foreign intelligence and are directed by the 
Government of Canada’s intelligence priorities. 


CSEC’s information technology security products and services enable its clients (other 
government departments and agencies) to effectively secure their electronic information 
systems and networks. CSEC also conducts research and development on behalf of the 
Government of Canada in fields related to communications security. 


CSEC has a three-part mandate under subsection 273.64(1) of the National Defence Act. 
These are known as parts (a) (b) and (c) of its mandate: 


(a) to acquire and use information from the global information infrastructure 
for the purpose of providing foreign intelligence, in accordance with 
Government of Canada intelligence priorities; 

(b) to provide advice, guidance and services to help ensure the protection of 
electronic information and of information infrastructures of importance to 
the Government of Canada; and 

(c) to provide technical and operational assistance to federal law enforcement 
and security agencies in the performance of their lawful duties. 
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INTRODUCTION 


This is my third report as Communications Security Establishment 
Commissioner. It is an appropriate time, in my view, to reflect upon the 
nature of the work in which my office is engaged and the quality of the 
relationship that has evolved between the Communications Security 
Establishment Canada (CSEC) and my office. 


Decades of legal experience have taught me that the most important 
element in any relationship is trust. This is true of all relationships, 
including the one between my office and CSEC. Trust, in my opinion, is 
not an entitlement. It is something that must be earned through integrity 
and professionalism. In the case of CSEC, it is also earned by 
demonstrating commitment to the protection of national security in a 
way that ensures compliance with the law and respect for the privacy of 
Canadians. In the case of my office, trust is earned through a rigorous, 
comprehensive and fair review process. 


Due to the nature of its work, CSEC is required to operate largely in 
secrecy. The role of my office is, in part, to represent the public interest 
in accountability in a way that optimizes effective review while not 
restricting unnecessarily CSEC’s legislated role. 


My predecessors and I have consistently recognized prevention as an 
important aspect of the Commissioner’s legislated role. As such, most 
recommendations address shortcomings in CSEC’s policies, procedures 
and practices in order to strengthen the compliance framework and 
reduce any risk to privacy. 


While I have, over the past three years, reported that I have found no 
instances of lack of compliance with the law, there may be, and have 
been, instances where disagreements with CSEC arise over a particular 
issue or where I am not satisfied with CSEC’s explanation or 
information. In such cases, I direct my staff to pursue the issue as 
thoroughly as required. The manner in which such matters are handled 
can enhance professional trust between organizations. 
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As my first term draws to a close, I take satisfaction in noting that 
mutual trust and commitment to shared democratic values have fostered 
a productive working relationship. I acknowledge the leadership of 
CSEC which has demonstrated its commitment to lawfulness and 
protecting privacy. 


THE REVIEW ENVIRONMENT 


Proposed amendments to the National 
Defence Act — 


Ensuring the integrity of CSEC’s activities and the 
review process 

In last year’s report I once again repeated my concern over ambiguities 
in Part V.I of the National Defence Act (NDA) with regard to CSEC’s 
foreign intelligence activities under ministerial authorization. I 
recommended a number of amendments, including one to clarify the 
term activity or class of activities. I also recommended that a definition 
of the terms intercept and interception be inserted into the Act. I have 
shared with government officials these and other proposals for 
amendments to the NDA that I believe worthwhile to enact. 


Ministerial authorizations — Did you know? 


A ministerial authorization is a written authorization provided by the Minister 
of National Defence which sets out conditions CSEC must meet so as not to 
be in contravention of the Criminal Code if, in the process of conducting its 
foreign intelligence collection or information technology security activities, — : . : 
it incidentally intercepts private communications of Canadians. Ministerial - 
authorizations may be approved or renewed for a period not exceeding _ 

one year. | 
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| Applying a qualified opinion 

| At the end of the 2008-2009 reporting period, I continue to apply the 
| interim solution put in place by my predecessors: that 1s, to review 

| CSEC’s foreign intelligence collection activities under ministerial 

_ authorizations on the basis of the NDA as it is interpreted by Justice 
Canada. However, in some important respects, I disagree with that 
interpretation — as have both my predecessors. 


| In April 2006, my immediate predecessor noted in his last report as 
CSE Commissioner that “my one regret will be if I leave this position 
. without a resolution of the legal interpretation issues that have 

| bedevilled this office since December 2001.” In my 2007-2008 report, 
| I noted the Government had indicated that legislative amendments 

_ would be brought forward “in due course”. This has yet to occur. I 
want to emphasize, however, that the length of time that has passed 
without producing amended legislation puts at risk the integrity of the 
_ review process. 


_ Observations of the Auditor General 

Tam pleased to see that the Auditor General has commented on this 
important matter. In a report released on March 31, 2009, she recognized 
that the implications of the CSE Commissioner’s qualified opinion of 
CSEC’s lawfulness, due to ambiguities in CSEC’s legislation, “are 
serious” (Section 1.14 of the 2009 Status Report of the Auditor General 
of Canada). 


Review cooperation 


One issue that remained unresolved in 2008-2009, stemming from 
Justice Dennis O’Connor’s report concerning a new review mechanism 
for the Royal Canadian Mounted Police’s (RCMP) national security 
activities, is whether there is a need for integrated review of integrated 
operations among enforcement and intelligence agencies. Justice 
O’Connor’s recommendations included “statutory gateways” to support 
integrated review. While cooperation among review bodies must be 
conducted in a manner that respects security requirements, including the 
Security of Information Act, | find no obstacles, legal or otherwise, to 
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such cooperation, if required. Moreover, I can, and do, review CSEC 
activities conducted under part (c) of its mandate — which involve 
requests for assistance to CSEC from the Canadian Security Intelligence 
Service (CSIS) and the RCMP — to ensure these activities are in 
compliance with the law. 


The O’Connor inquiry included the examination of information sharing 
between agencies from different countries. This theme has been 
discussed by Canadian and international scholars. At the annual 
conference of the Canadian Association of Security and Intelligence 
Studies (CASIS), held in October 2008, reference was made to an 
“accountability gap”, concerning an absence of cooperation between 
review bodies of different countries to review information sharing 
agreements among their respective intelligence agencies. This is a 
sensitive area but one that is of great interest to me, particularly as it 
relates to the potential sharing of personal information about Canadians. 
Within my own jurisdiction, in the coming year, I will be conducting a 
review of CSEC’s activities in this area. 


Parliamentary committee involvement 


The Government of Canada has called for increased parliamentary 
involvement in the review of security and intelligence activities. 
Traditionally, a role for parliamentarians has been clearly established 
through the mechanism of Parliamentary committees: in the case of my 
office, it is the Standing Committee on National Defence, to which my 
public annual report is referred. Since the creation of the CSE 
Commissioner’s office in 1996, the Commissioner has been invited to 
appear before this committee to discuss his activities and findings and 
to answer parliamentarians’ questions quite infrequently. 
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THE YEAR IN REVIEW 


| Safeguarding privacy: Regular review of identity 
_disclosures 


| Following my in-depth review of CSEC’s disclosure of information 

| about Canadians to Government of Canada clients, completed in 

| December 2008, it was suggested by CSEC that reviews of this kind 

| could be conducted on a regular basis. Since this CSEC activity lies at 
| the heart of my mandate, I believe it is worthwhile to examine it 

| regularly. As a result, my office has arranged with CSEC to begin 

| reviews at regular intervals throughout the coming reporting year. 


| J believe the nature of this CSEC suggestion, and the manner in which it 
was presented to my office, speaks to the professional trust that has 

_ evolved in the relationship between our respective organizations. It isa 

_ positive sign, and one which I am pleased to highlight in this report. 


Information about Canadians — Did you know? 


When collecting foreign intelligence, CSEC may incidentally acquire 
information about Canadians. This information may be retained if it is 
assessed as essential to the understanding of the foreign intelligence. 
Information about Canadians may be included in foreign intelligence 
reporting only if it is suppressed (i.e. replaced by a generic reference 
such as “a Canadian person”). When receiving a subsequent request 
for disclosure of the details of the suppressed information, CSEC requires 
federal departments and agencies to explain their authority to request 
and use this information under their respective mandates and to 
provide an operational justification of their need to know this 
information. Only after these conditions have been met will CSEC 
release the suppressed information. 
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Briefings from CSEC 


My office is briefed regularly on CSEC operational policies and relevant 
administrative activities. In 2008—2009, my office was also provided 
with presentations and training in the areas of information management 
and information technology (IT) databases, on the safeguarding of IT 
networks of importance to the Government of Canada, and on the status 
of CSEC’s policy framework. In addition, CSEC provided briefings 
specific to certain reviews prior to those reviews being undertaken. 


More effective review through annual 
roundtables 


For the past two years, my staff and CSEC officials have participated in 
what has become an annual roundtable meeting aimed at optimizing the 
review process, while minimizing any adverse impact on CSEC’s 
legislated activities. The roundtable meeting is also an opportunity to 
reinforce open communication and to enhance mutual understanding and 
trust in the working relationship between the two organizations. These 
meetings have proven useful in removing obstacles to effective review 
and will, I am sure, enable us to make progress in the years ahead. 


Strengthening lawful compliance 


The objective of my review mandate is to assess whether CSEC’s 
activities comply with the law, including the extent to which CSEC has 
adequate measures to protect the privacy of Canadians. While I am to 
report to the Minister and to the Attorney General of Canada any 
instances of non-compliance with the law, I also make it a point, 
wherever possible, to identify preventive measures that reinforce 
CSEC’s lawful compliance. 
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| One area in which my predecessors and I consistently called for 
| preventive measures is improved information management practices. As 
| we all previously noted, the absence of an adequate records management 


system impaired CSEC’s ability to account for its activities. In response 


| to these concerns, CSEC has taken positive steps to rectify gaps in 

| record management practices. In fact, a new corporate records 

| management system is expected to be fully operational during the 

_ 2009-2010 reporting period. CSEC is to be commended for its efforts in 
| this important area. 


A comprehensive review process 


In its reviews, my office sometimes goes into great depth, observing 


_ CSEC operators and analysts first hand to gain better knowledge of their 
_ work. This knowledge is particularly important when my staff examine 


an area in which I have made a recommendation with which CSEC 


_ disagrees. 


This year, in one such case, which I describe in the section on Review 


Highlights, I revisited a recommendation relating to privacy, which was 
made last year. Following completion of a second, focussed review, I 


_ retracted that recommendation because I was satisfied that the risk to 

_ privacy was minimal and that CSEC had appropriate safeguards in place. 
_ I believe this retraction results from a rigourous but fair review approach 
which, in this instance, recognized the professional manner in which 

_ these particular analysts strive to conduct their work. 


Implementing recommendations — Did you know? 


Since 1997, my office has submitted 52 reports to the Minister, many of 


2. which have contained substantial recommendations. CSEC has accepted 
and implemented and/or is working to address over 90 percent of these 
recommendations, which speaks to the effectiveness of the review process. 
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METHODOLOGY 


Identifying risks to lawfulness and privacy 


A key ingredient in developing a sound review selection process is the 
identification of activities, practices or procedures that may pose a risk 
to CSEC’s compliance with the law. For example, these can be potential 
risks identified by my staff from previous or current reviews of CSEC 
activities, or from briefing sessions given to my staff by CSEC. CSEC 
may itself also identify potential risks. 


In assessing topics for possible review, I instruct my staff to consider 
questions such as: to what extent is CSEC exposed to risk of unlawful 
activity in this area, and what is the likelihood that this could occur?; and 
if it occurs, what is the potential adverse impact? 


In addition, my staff developed more detailed criteria in 2008—2009 to 
help determine the priority in which the identified areas of potential risk 
will be reviewed. These criteria, which continue to be refined, include: 
significant changes to authorities; changes to technology; any area that 
has never been reviewed in-depth, or has not been reviewed in the past 
four years; a follow-up to a particular recommendation I made 
previously; and issues arising in the public domain. 


Attributes of a good review 


In conducting a review, my staff examine all relevant written and 
electronic records, files, correspondence and other documentation. My 
staff conduct interviews with CSEC managers and staff involved in the 
activities being reviewed and visit CSEC facilities to conduct checks, 
including CSEC databases. The results of reviews are shared with CSEC 
and, in most instances, CSEC takes action to strengthen compliance with 
the law or policy. 


One of my primary concerns in the review of CSEC activities is ensuring 
that each review is based upon appropriate evidence to support all 
findings, conclusions and recommendations. This means that all 
evidence gathered must be directly relevant, replicable and valid. 


ANNUAL REPORT 


| Review evidence — Did you know? 


| Evidence is information and data that are collected and used to provide 
a factual basis for developing findings and recommendations against 
_ review criteria. 


Relevant: refers to the extent to which the information bears a clear and 
logical relationship to the review objective(s) and criteria. If information 
is not relevant, it cannot be evidence. Replicable: concerns the 
likelihood of coming up with the same findings if all steps of the review 
| were reproduced. Valid: refers to whether the information actually is 

| what it purports to be in relation to the content, origin and timing. As a 


| general principle, the quantity of evidence is sufficient when there is 


| 


enough to persuade a reasonable person that the review findings and 


| conclusions are valid and the recommendations are appropriate. In order 
to decide if the collective weight of the evidence is sufficient, I must 
consider the quality of the evidence gathered, and the cost of obtaining 

_ more evidence relative to its likely benefits. 


| Developing review findings and recommendations 

The comparison of evidence gathered against previously established 
review criteria results in the development of usable findings and 
recommendations. Review findings confirm whether criteria have been 
satisfactorily met, or disclose the level, nature and significance of 
deviations from them. The process of assessing the evidence gathered 

| against criteria is focussed on questions such as: does a deficiency exist 
_ between findings and expectations and as established by the review 
criteria? what is the cause of the deficiency? what are its likely impacts? 
_ and can the deficiency be corrected? 


2008-2009 REVIEW HIGHLIGHTS 


During the 2008-2009 reporting period, my office completed seven 
reviews on different aspects of CSEC activities. The reviews were 
carried out under my authority as articulated in paragraph 273.63(2)(a) 
and subsection 273.65(8) of the NDA. 


The primary objective of the reviews, consistent with my mandate, was 
to assess whether the activities complied with the law, including the 
extent to which CSEC has adequate measures in place to protect the 
privacy of Canadians. I am able to report that the activities examined in 
2008-2009 complied with the law. 


With respect to the first three of the reviews listed below, in which I 
have reviewed different foreign intelligence collection activities 
conducted under ministerial authorizations, I reiterate that, pending 
amendments to clarify the NDA, these reviews are based on legal 
interpretation provided to CSEC by Justice Canada. 


Reviews of foreign intelligence activities under 
ministerial authorizations — Common elements 


Paragraph 273.64(1)(a) of the NDA authorizes CSEC to collect foreign 
intelligence in accordance with the Government of Canada’s intelligence 
priorities. In the case of each of the CSEC foreign intelligence collection 
activities reviewed by my office in 2008-2009, CSEC obtained the 
ministerial authorization pursuant to subsections 273.65(1) and (2) of the 
NDA because, in carrying out the activities, it was possible that CSEC 
might intercept communications that either originated or terminated in 
Canada, and which constituted “private communications”, as defined in 
the Criminal Code. 


The NDA requires that foreign intelligence collection activities not be 
directed at Canadians or any person in Canada (paragraph 273.64(2)(a)), 
and that they be subject to measures to protect the privacy of Canadians in 
the use and retention of intercepted information (paragraph 273.64(2)(b)). 
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Review of CSEC foreign intelligence collection 
activities conducted under ministerial 
authorizations (Activity 1) 


Background 

This review examined certain CSEC foreign intelligence collection 

| activities conducted under three successive ministerial authorizations in 
| effect between 2004 and 2007. Two previous reviews of these same 

| activities conducted by my office in 1999 and 2005 respectively were 

| taken into consideration. 


_ Findings 

Based on the information reviewed and interviews conducted, I found 
| that CSEC’s activities were authorized and carried out in accordance 

_ with the law, ministerial requirements, and its operational policies and 
| procedures. 


| However, the review found that additional information should be 
recorded and reported to the Minister in order to enhance accountability. 
_ This additional information concerns the foreign intelligence CSEC 
collects under this ministerial authorization and which it shares with its 

| principal partners outside Canada. The sharing of information about 

| Canadians is an area that my office will continue to examine. 


| The review also found that a memorandum of understanding between 

| CSEC and a federal department respecting these activities should be 

| updated to reflect current practices. In the meantime, CSEC agreed to 

| continue to follow the terms of the existing agreement and to document 
any new understandings. 


In addition, my staff identified certain deficiencies in CSEC policies and 
procedures related to the activities reviewed. 
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Recommendations 

As a result of these findings, I recommended that CSEC adopt and 
publish additional written guidance respecting the process its analysts 
are to follow when making targeting decisions. I also recommended that 
CSEC amend its policy respecting the deletion of private 
communications recognized by analysts and found to have no foreign 
intelligence value. The NDA requires that an intercepted private 
communication shall be used or retained only if it is essential to 
international affairs, defence or security (paragraph 273.65(2)(d)). 


I am pleased to note that CSEC accepted the recommendations, and is 
making improvements in areas where deficiencies were identified, 
including making changes to its systems. 


Review of CSEC foreign intelligence collection 
activities conducted under ministerial 
authorizations (Activity 2) 


Background 

This review examined certain other CSEC foreign intelligence collection 
activities conducted under four ministerial authorizations in effect from 
2004 to 2007. The review included an examination of CSEC’s reporting 
of the foreign intelligence to its partners in Canada and abroad. 


Findings 

Based on the information reviewed and interviews conducted, I found 
that the activities were authorized and complied with the law and with 
CSEC operational policies and procedures. Personnel responsible for the 
collection and management of intelligence activities were interviewed 
and found to be knowledgeable about the legislative authorities, policies 
and procedures that govern CSEC’s collection. 
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However, the review also found that CSEC did not meet two of the 
expectations set out in the ministerial authorizations. In one instance, it 
was noted that CSEC did not meet a requirement to report in a timely 
manner to the Minister of National Defence following the expiration of 
the ministerial authorization. My staff found that the report was not 
received by the Minister’s office until almost one year later. 


Secondly, it was noted that in one instance CSEC did not report to the 
Minister an important increase in the number of private communications 
it inadvertently intercepted. CSEC subsequently provided my office with 
an explanation for this omission. Nevertheless, in reviewing this issue, I 
assessed that the information should have been reported in order to meet 
the ministerial expectation. 


My report to the Minister of National Defence also suggested that CSEC 
introduce a greater degree of rigour in methodology applied to assessing 
the value of foreign intelligence reporting. 


Recommendation 

In addressing the expectation regarding private communications, I 
recommended that CSEC make an explicit statement to address each 
ministerial expectation separately in future reports to the Minister. I am 
pleased to note that CSEC accepted this recommendation. 
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Review of CSEC foreign intelligence collection 
activities conducted under a ministerial 
directive and ministerial authorizations 
(Activity 3) 


Background 

This review examined a third type of CSEC foreign intelligence 
collection activity conducted under three successive ministerial 
authorizations in effect from 2004 to 2007. In addition, the review 
examined CSEC’s compliance with the expectations set out in a 
related ministerial directive, issued pursuant to subsection 273.62(3) 
of the NDA. 


Findings | 

Based on the information reviewed and interviews conducted, I found 
that CSEC’s activities were authorized and complied with the law. I did, 
however, set out specific findings and made recommendations that I 
believe would strengthen CSEC’s practices and compliance with its 
policies and procedures. 


The review also found that CSEC did not meet one expectation set out in 
the ministerial directive. However, practices at the working level 
resulted in the fulfilment of the intention of that expectation. 


Rigorous business practices at the working level throughout the 
development, approval and execution of these activities give a high level 
of assurance that the activities are conducted as approved. The review 
did not find the same level of clarity, rigour and record keeping in some 
parts of the program management processes. As a consequence, I made 
three recommendations. 
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Recommendations 

With respect to CSEC not meeting one expectation of the ministerial 
directive, and to ensure continuity of practice through time and any staff 
turnover, I recommended that CSEC include certain measures in its 
policies or procedures. 


Second, while CSEC personnel demonstrated a clear understanding of 
associated policies and procedures, and there was no suggestion of non- 
compliance, I recommended that written guidelines be put in place to 
address certain deficiencies in policies and procedures. 


Finally, the record of specific activities is comprehensively documented. 
In contrast, however, the record of decision related to the management of 
the program is incomplete. I recommended that both components be 
subject to the proper application of sound records management 
processes. As I observed previously, CSEC has been implementing a 
new records management system and is keeping my office informed of 
progress, which I am following with interest. I am pleased to note that 
CSEC has accepted these recommendations and is taking measures to 
address each of them. 


Review of CSEC’s acquisition and implementation 
of technologies as a means lo protect the 
privacy of Canadians 

Background 

My office reviewed CSEC’s acquisition and implementation of 


technologies as a means to protect the privacy of Canadians, in 
accordance with subsection 273.64(2) of the NDA. 
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Two types of technologies were studied in this review: a foreign 
intelligence acquisition system and an analytical tool. The foreign 
intelligence acquisition system is used to acquire, process and collect 
information from the global information infrastructure. The analytical 
tool is used to support CSEC’s collection of foreign intelligence and to 
help ensure the protection of electronic information and information 
infrastructures of importance to the Government of Canada (IT security). 
My staff observed demonstrations of the two technologies and queried 
CSEC operators on various aspects of their use. 


Findings 

Based on the information reviewed and interviews conducted, I found 
that CSEC’s activities were carried out in accordance with the law. 
CSEC uses these two technologies to fulfill its legislated mandate and 
demonstrated that it would modify its technologies, if required, to 
comply with its statutory obligations to protect the privacy of Canadians. 
The acquisition, implementation and use of these technologies helps 
CSEC protect the privacy of Canadians by identifying potential private 
communications as well as personal information about Canadians. 


The review found that special attention should be brought to the 
development of IT security policy instruments so as to ensure that 
CSEC’s guidance in this regard is up-to-date and formalized at the 
highest level. There was a difference in practices between CSEC’s two 
business-lines (IT security and foreign intelligence collection) with 
regard to accounting for personal information identified through 
analysis. CSEC provided a reasonable explanation for this difference. 
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Recommendation 

I made one recommendation regarding requests for foreign intelligence 
ministerial authorizations. Since there is a risk of intercepting private 
communications when using the foreign intelligence acquisition system 
reviewed, a ministerial authorization was required. I recommended that 
CSEC re-evaluate how it describes foreign intelligence activities in its 
requests for ministerial authorizations so as to be more precise about the 
activities the Minister of National Defence is authorizing. I am pleased 
to note that CSEC accepted the recommendation. 


Review of disclosure of information about 
Canadians to Government of Canada clients 


Background 

As part of its mandate to provide foreign intelligence in accordance with 
Government of Canada intelligence priorities, CSEC disseminates 
classified reports to federal government departments and agencies that 
have demonstrated requirements for the information, based on their 
respective mandates. These reports are authored by CSEC as well as 
allied agencies and may contain suppressed information about Canadians 
if it is essential to the understanding of the report (see: /nformation 
about Canadians — Did you know?). 


Findings 

Based on the information reviewed and interviews conducted, I found 
that CSEC’s activities complied with the law and with its operational 
policies and procedures. I made no recommendations. 
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Follow-up to a recommendation in a 2007-2008 
review of CSEC activities carried out under a 
ministerial directive 


Background 

Last year, I reported on certain activities undertaken by CSEC under a 
ministerial directive and in support of its foreign intelligence collection 
mandate. As indicated in my 2007-2008 Annual Report, I suggested that 
CSEC re-examine its practice that only those private communications 
recognized by certain staff be accounted for. I recommended that other 
staff who observe and handle private communications should also be 
responsible for accounting for them. CSEC did not accept this 
recommendation, and, as a result, I directed my staff to conduct a 
follow-up review of these activities. 


This second, focussed review, with direction to probe this matter as deeply 
as necessary, aimed to acquire greater knowledge about this activity, to 
examine the risk to privacy, and to determine if CSEC’s measures to protect 
the privacy of Canadians were sufficient in this instance. 


The goal of this review was ultimately to determine whether my 
recommendation of 2007—2008 should be maintained, amended or 
retracted. Review methodology included first-hand observation of the 
activities of CSEC front-line personnel conducting this activity. 


Findings 

The review, based on detailed knowledge and understanding of activities 
observed by my staff, found that CSEC conducts these activities in 
accordance with the law and ministerial requirements, and in accordance 
with operational policies and procedures. 
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Based on the current practices, as observed in detail on two separate 
occasions, I assessed that the activities examined in this review involve 
only a low risk to privacy. CSEC staff conducting the activities have a 
different and lesser potential of affecting the privacy of Canadians than 
other staff conducting different activities and who are already required to 
account for private communications. 


In addition, I assessed that CSEC has sufficient measures in place to 
protect the privacy of Canadians during its conduct of these activities. 
Personnel were aware of and followed operational policies and 
procedures that provide direction with respect to the protection of the 
privacy of Canadians. 


I am pleased to note that CSEC recently revised its operational policy 
on this subject to include additional guidance respecting the protection 
of the privacy of Canadians. Managers routinely and closely monitor 
compliance with applicable policies and procedures. The people with 
whom my staff spoke were forthcoming and demonstrated a 
professional approach. 


Therefore, in view of these findings, I retracted my previous 
recommendation and informed CSEC that I have no expectation of 
corrective action in regard to these activities. 


Review of CSEC activities conducted under a 
ministerial directive and in support of its foreign 
intelligence collection mandate 


Background 

The specific objective of this review was to acquire knowledge of 
CSEC’s activities conducted under a ministerial directive and in support 
of its foreign intelligence collection mandate. I examined CSEC’s 
compliance with the expectations set out in the ministerial directive and 
associated policies and procedures. These expectations are administrative 
in nature and relate primarily to security and risk management. 
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Findings 

Based on the information reviewed and interviews conducted, I found 
that CSEC’s activities were consistent with the foreign intelligence 
priorities of the Government of Canada, and were carried out in 
accordance with the law and with CSEC operational policies and 
procedures. CSEC had also taken specific measures to protect the 
privacy of Canadians. I also found that, for the most part, CSEC 
conducted the activities in accordance with expectations set out in the 
ministerial directive and with associated policies and procedures. 


Recommendations 

I recommended, however, that CSEC reconcile certain discrepancies 
between ministerial expectations and its own practices. I also 
recommended that CSEC review, update and finalize certain key 
documents respecting these activities, and that it clarify certain terms 
used in the documents. I believe this will strengthen CSEC’s ability to 
meet the ministerial expectations and therefore enhance accountability. 
I am awaiting CSEC’s response to these recommendations. 


REVIEWS UNDERWAY AND PLANNED 


I am pleased to note that of the reviews I indicated were underway in my 
report last year, all were completed, though the results of the 
comprehensive study of CSEC’s information technology security 
activities will be submitted to the Minister early in the next reporting 
year. In addition, the examination of certain common practices of CSEC 
related to its mandated activities, has been split into several reviews to 
permit more detailed examination. The first of these, on disclosure of 
information about Canadians, was completed and submitted to the 
Minister in this reporting year. 
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Other reviews that are underway or planned for the next reporting year 
include: CSEC’s foreign intelligence sharing with international partners; 
activities conducted under foreign intelligence ministerial authorizations; 
activities conducted under IT security ministerial authorizations; the 
process by which CSEC determines that targets of foreign intelligence 
interest are indeed foreign entities located outside Canada, as required 
by law; and CSEC’s assistance (under part (c) of its mandate) to the 
Canadian Security Intelligence Service under section 16 of the CSIS Act. 


Some of these reviews may carry over into the 2010-2011 reporting year. 
There may also be a certain area or activity that, as a result of various 
factors, I determine to be a priority, resulting in it being reviewed sooner 
rather than later. This situation is part of the ongoing process of assessing 
where risks to lawful compliance or privacy are greatest. 


COMPLAINTS ABOUT CSEC’S ACTIVITIES 


My mandate includes undertaking any investigation I deem necessary in 
response to a complaint in order to determine whether CSEC engaged, or 
is engaging, in unlawful activity. 


This year my office received one complaint warranting investigation. 


While I cannot speak to the substance of the complaint, I am able to report 
that the investigation found no unlawful activity on the part of CSEC. 
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DUTIES UNDER THE SECURITY OF INFORMATION 
ACT 


I have a duty under the Security of Information Act to receive 
information from persons who are permanently bound to secrecy and 
seek to defend the release of classified information about CSEC on the 
grounds that it is in the public interest. No such matters were reported to 
my office in the 2008-2009 reporting period. 


THE COMMISSIONER'S OFFICE 


During 2008—2009, I met periodically with the Chief of CSEC to discuss 
issues of mutual interest. These collaborative meetings reflect a 
productive working relationship which, I believe, contributes to the 
overall efficiency and effectiveness of the review process. 


I had occasion during the reporting period to meet the Prime Minister’s 
newly appointed National Security Advisor, whose duties include 
accountability for CSEC policy and operational direction. I also met 
with several federal court judges and other senior government officials. 


My office’s new status 


As I observed in my last report, a decision was taken in the autumn of 
2007 that would sever my office’s long-standing relationship with the 
Privy Council Office for the provision of administrative and other 
support activities and transfer these responsibilities to the Department of 
National Defence. 
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Subsequently, it was determined that positioning my office within the 
same portfolio as CSEC did not have the appearance of propriety and 
autonomy that ought to exist between an agency and its review body. As 
a result, and effective April 1, 2009, my office was granted its own 
parliamentary appropriation. While the reporting relationship to the 
Minister of National Defence remains intact, as set out in the NDA, my 
office is separate from, and is not part of, that department. 


| These changes have, by necessity, given rise to additional expenditures 
for support services, with a corresponding increase in the budget which 
appears at Annex C. Still, I view this new status as another indication of 
the maturation of my office and further reinforcement of its 
‘Independence. 


Canadian Association of Security and 
Intelligence Studies 2008 Conference 


My office’s participation in the annual CASIS conference in October 
2008 afforded an excellent opportunity to exchange perspectives on 
security and intelligence issues, including review, with leading experts, 
scholars, policy makers and practitioners from across the country. My 
office was also pleased to mentor two Canadian graduate students in 


security and intelligence studies in conference events and discussions. 


International Intelligence Review Agencies 
Conference 


I attended the International Intelligence Review Agencies Conference in 
Auckland, New Zealand in October 2008 to make a presentation to a 
conference panel on developing trust between a review body and the 
agency being reviewed, while retaining independence. In my remarks, I 
emphasized that building and maintaining CSEC’s trust in my office, 
while safeguarding my office’s independence, requires constant 
management and accommodation of interests at all levels. 
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I also emphasized that CSEC’s trust in the Commissioner’s office 
depends significantly on the demonstrable quality of its review work. As 
a result, my office has placed considerable emphasis on developing, 
documenting and implementing sound methodologies, based on accepted 
standards of review and informed by years of practical experience. I 
added that my office has developed operational policies and procedures 
that, among other things, provide guidance to staff in carrying out 
reviews, ensure a large measure of transparency and consistency in my 
office’s work when seen from CSEC’s perspective, and provide a basis 
for assessing and improving CSEC’s own performance in implementing 
its mandate. 


British Intelligence and Security Committee of 
Parliamentarians 


I met with the British Intelligence and Security Committee of 
Parliamentarians during the Committee’s visit to Ottawa in March 2009. 
Committee members and my staff and I participated in a useful 
exchange of information and opinions on security and intelligence 
review issues of mutual interest and concern. 


IN CLOSING 


As I conclude my first term as CSE Commissioner and prepare to 
embark upon a second term in August 2009 for one year, I do so with 
satisfaction in current achievements and a sense of optimism going 
forward. Over the past three years I am pleased to have established a 
productive working relationship with the Chief of CSEC. I look forward 
to building on this relationship as I continue to review CSEC’s activities 
in accordance with my mandate. For me, comprehensive review of these 
activities remains both a challenging and rewarding task, and one which 
I am greatly honoured to carry out on behalf of Canadians. 
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ANNEX A: MANDATE OF THE COMMUNICATIONS SECURITY 
ESTABLISHMENT COMMISSIONER 


National Defence Act — Part V.1 


273.63 (1) The Governor in Council may appoint a supernumerary judge or a retired 
judge of a superior court as Commissioner of the Communications Security 
Establishment to hold office, during good behaviour, for a term of not more 
than five years. 


(2) The duties of the Commissioner are 


(a) to review the activities of the Establishment to ensure that they are in 
compliance with the law; 


(b) in response to a complaint, to undertake any investigation that the 
Commissioner considers necessary; and 


(c) to inform the Minister and the Attorney General of Canada of any 
activity of the Establishment that the Commissioner believes may not be 
in compliance with the law. 


(3) The Commissioner shall, within 90 days after the end of each fiscal year, 
submit an annual report to the Minister on the Commissioner’s activities and 
findings, and the Minister shall cause a copy of the report to be laid before 
each House of Parliament on any of the first 15 days on which that House is 
sitting after the Minister receives the report. 


(4) In carrying out his or her duties, the Commissioner has all the powers of a 
commissioner under Part II of the /nquiries Act. 


(5) The Commissioner may engage the services of such legal counsel, technical 
advisers and assistants as the Commissioner considers necessary for the 
proper performance of his or her duties and, with the approval of the Treasury 
Board, may fix and pay their remuneration and expenses. 
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(6) The Commissioner shall carry out such duties and functions as are assigned 
to the Commissioner by this Part or any other Act of Parliament, and may 
carry out or engage in such other related assignments or activities as may be 
authorized by the Governor in Council. 


(7) The Commissioner of the Communications Security Establishment holding 
office immediately before the coming into force of this section shall continue 
in office for the remainder of the term for which he or she was appointed. 


el 


273.65 (8) The Commissioner of the Communications Security Establishment shall 
review activities carried out under an authorization issued under this section 
to ensure that they are authorized and report annually to the Minister on 
the review. 


Security of Information Act 


15. (1) No person is guilty of an offence under section 13 or 14 if the person establishes 
that he or she acted in the public interest. [...] 


(5) A judge or court may decide whether the public interest in the disclosure 
outweighs the public interest in non-disclosure only if the person has complied 
with the following: [...] 


(b) the person has, if he or she has not received a response from the deputy head 
or the Deputy Attorney General of Canada, as the case may be, within a 
reasonable time, brought his or her concern to, and provided all relevant 
information in the person’s possession to, [...] 


(11) the Communications Security Establishment Commissioner, if the 
person’s concern relates to an alleged offence that has been, is being or is 
about to be committed by a member of the Communications Security 
Establishment, in the purported performance of that person’s duties and 
functions of service for, or on behalf of, the Communications Security 
Establishment, and he or she has not received a response from the 
Communications Security Establishment Commissioner within a 
reasonable time. 
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ANNEX B: CLASSIFIED REPORTS, 1996-2009 

1. Principal vs. agent status — March 3, 1997 (TOP SECRET) 

2. Operational policies with lawfulness implications — February 6, 1998 (SECRET) 

3. CSE’s activities under *** — March 5, 1998 (TOP SECRET Codeword/CEO) 

4. Internal investigations and complaints — March 10, 1998 (SECRET) 

5. CSE’s activities under *** — December 10, 1998 (TOP SECRET/CEO) 


6. On controlling communications security (COMSEC) material — May 6, 1999 
(TOP SECRET) 


7. How we test (A classified report on the testing of CSE’s signals intelligence 
collection and holding practices, and an assessment of the organization’s efforts 
to safeguard the privacy of Canadians) — June 14, 1999 
(TOP SECRET Codeword/CEO) 


8. A study of the *** collection program — November 19, 1999 (TOP SECRET 
Codeword/CEO) 


9. On ***— December 8, 1999 (TOP SECRET/COMINT) 


10. A study of CSE’s *** reporting process — an overview (Phase I) 
— December 8, 1999 (SECRET/CEO) 


11. A study of selection and *** — an overview — May 10, 2000 (TOP SECRET/CEO) 


12. CSE’s operational support activities under *** — follow-up — May 10, 2000 
(TOP SECRET/CEO) 


13. Internal investigations and complaints — follow-up — May 10, 2000 (SECRET) 


14. On findings of an external review of CSE’s ITS program — June 15, 2000 
(SECRET) 


15. CSE’s policy system review — September 13, 2000 (TOP SECRET/CEO) 
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16. A study of the *** reporting process — *** (Phase IT) — April 6, 2001 
(SECRET/CEO) 


17. A study of the *** reporting process — *** (Phase IIT) — April 6, 2001 
(SECRET/CEO) 


18. CSE’s participation *** — August 20, 2001 (TOP SECRET/CEO) 


19. CSE’s support to ***, as authorized by *** and code-named *** — August 20, 2001 
(TOP SECRET/CEO) 


20. A study of the formal agreements in place between CSE and various external 
parties in respect of CSE’s Information Technology Security (ITS) 
— August 21, 2002 (SECRET) 


21. CSE’s support to ***, as authorized by *** and code-named *** — November 13, 
2002 (TOP SECREI/CEO) 


22. CSE’s *** activities carried out under the *** 2002 *** Ministerial authorization 
— November 27, 2002 (TOP SECRET/CEO) 


23. Lexicon of CSE definitions — March 26, 2003 (TOP SECRET) 


24. CSE’s activities pursuant to *** Ministerial authorizations including *** 
— May 20, 2003 (SECRET) 


25. CSE’s support to ***, as authorized by *** and code-named *** — Part I 
— November 6, 2003 (TOP SECRET/COMINT/CEO) 


26. CSE’s support to ***, as authorized by *** and code-named *** — Part II 
— March 15, 2004 (TOP SECRET/COMINT/CEO) 


27. Areview of CSE’s activities conducted under *** Ministerial authorization 
— March 19, 2004 (SECRET/CEO) 


28. Internal investigations and complaints — follow-up — March 25, 2004 
(TOP SECRET/CEO) 
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29. 


30. 


pl. 


32. 


ba. 


34. 
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36. 
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38. 


BY. 


40. 


41. 


A review of CSE’s activities conducted under 2002 *** Ministerial authorization 
— April 19, 2004 (SECRET/CEO) 


Review of CSE *** operations under Ministerial authorization — June 1, 2004 
(TOP SECRET/COMINT) 


CSE’s support to *** — January 7, 2005 (TOP SECRET/COMINT/CEO) 


External review of CSE’s *** activities conducted under Ministerial authorization 
— February 28, 2005 (TOP SECRET/COMINT/CEO) 


A study of the *** collection program — March 15, 2005 (TOP SECRET/ 
COMINT/CEO) 


Report on the activities of CSE’s *** — June 22, 2005 (TOP SECRET) 


Interim report on CSE’s *** operations conducted under Ministerial authorization 
— March 2, 2006 (TOP SECRET/COMINT) 


External review of CSE *** activities conducted under Ministerial authorization 
— March 29, 2006 (TOP SECRET/CEO) 


Review of CSE’s foreign intelligence collection in support of the RCMP (Phase II) 
— June 16, 2006 (TOP SECRET/COMINT/CEO) 


Review of information technology security activities at a government department 
under ministerial authorization — December 18, 2006 (TOP SECRET) 


Review of CSE signals intelligence collection activities conducted under ministerial 
authorizations (Phase I) — February 20, 2007 (TOP SECRET/COMINT/CEO) 


Role of the CSE's client relations officers and the Operational Policy Section in the 
release of personal information — March 31, 2007 (TOP SECRET/COMINT/CEO) 


Review of information technology security activities at a government department 
under ministerial authorization — July 20, 2007 (TOP SECRET) 
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42. Review of CSEC’s counter-terrorism activities — October 16, 2007 (TOP SECRET/ 
COMINT/CEO) 


43. Review of CSE’s activities carried out under a ministerial directive — January 9, 2008 
(TOP SECRET/COMINT/CEO) 


44. Review of CSEC’s support to CSIS — January 16, 2008 (TOP SECRET/ 
COMINT/ CEO) : 


45. Review of CSEC signals intelligence collection activities conducted under 
ministerial authorizations (Phase IT) — March 28, 2008 (TOP SECRET/ 
COMINT/CEO) 


46. Review of CSEC’s acquisition and implementation of technologies as a means to 
protect the privacy of Canadians — June 11, 2008 (TOP SECRET/COMINT/CEO) 


47. Review of CSEC foreign intelligence collection activities conducted under 
ministerial authorizations (Activity 1) — June 11, 2008 (TOP SECRET/ 
COMINT/CEO) 


48. Review of disclosure of information about Canadians to Government of Canada 
clients —- November 19, 2008 (TOP SECRET/COMINT/CEO) 


49, Review of CSEC foreign intelligence collection activities conducted under 
ministerial authorizations (Activity 2) — January 13, 2009 (TOP SECRET/ 
COMINT/CEO) 


50. Review of CSEC foreign intelligence collection activities conducted under a 
ministerial directive and ministerial authorizations (Activity 3) 
— February 26, 2009 (TOP SECRET/COMINT/CEO) 


51. Review of CSEC activities conducted under a ministerial directive and in support 
of its foreign intelligence collection mandate — March 12, 2009 (TOP SECRET/ 
COMINT Codeword/CEO) 


52. Follow-up to a recommendation in a 2007-2008 review of CSEC activities carried 
out under a ministerial directive — March 12, 2009 (TOP SECRET/ COMINT/CEO) 
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ANNEX C: STATEMENT OF EXPENDITURES 2008-2009 


Standard Object Summary 

Salaries and Wages $782,686 
Transportation and Telecommunications 43,337 
Information 16,303 
Professional and Special Services 258,294 
Rentals IS 271 
Purchased Repair and Maintenance 1,913 
Materials and Supplies 12822 
Acquisition of Machinery and Equipment 25595 
Other Expenditures 0 
Total $1,291,321 
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ANNEX D: HISTORY OF THE OFFICE OF THE 
COMMUNICATIONS SECURITY ESTABLISHMENT 
COMMISSIONER (OCSEC) 


The Office of the Communications Security Establishment Commissioner (OCSEC) 
was created on June 19, 1996, with the appointment of the inaugural Commissioner, the 
Honourable Claude Bisson, O.C., a former Chief Justice of Québec, who held the 
position until June 2003. He was succeeded by the late Right Honourable Antonio 
Lamer, P.C., C.C., C.D., LL.D., D.U., former Chief Justice of Canada for a term of three 
years. The Honourable Charles D. Gonthier, C.C., Q.C., who retired as Justice of the 
Supreme Court of Canada in 2003, was appointed as Commissioner in August 2006. 


For the first six years (from June 1996 to December 2001), the Commissioner carried out 
his duties under the authority of Orders in Council issued pursuant to Part II of the 
Inquiries Act. During this period, the Commissioner’s responsibilities were twofold: to 


| review the activities of the Communications Security Establishment Canada (CSEC) to 
| determine whether they conformed with the laws of Canada; and to receive complaints 


about CSEC’s activities. 


Following the terrorist attacks in the United States on September 11, 2001, Parliament 
_ adopted the omnibus Anti-terrorism Act which came into force on December 24, 2001. 
The omnibus Act introduced amendments to the National Defence Act, by adding Part 
_ V.1 and creating legislative frameworks for both OCSEC and CSEC. It also gave the 


Commissioner new responsibilities to review activities carried out by CSEC under a 
ministerial authorization. 


The omnibus legislation also introduced the Security of Information Act, which replaced 
the Official Secrets Act. This legislation gives the Commissioner specific duties in the 


_ event that a person, who would otherwise be permanently bound to secrecy, seeks to 
_ defend the release of classified information about CSEC on the grounds that it is in the 


public interest. The legislation also continued the Commissioner’s powers under the 
Inquiries Act. 
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In autumn 2007, a decision was taken that would sever OCSEC’s long-standing 
arrangements with the Privy Council Office for administrative and other support 
activities. Effective April 1, 2009, OCSEC was granted its own parliamentary 
appropriation. While the Commissioner continues to provide the Minister of National 
Defence with his reports, OCSEC is separate from, and not part of, the department. 
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ANNEX E: ROLE AND MANDATE OF THE COMMUNICATIONS 
SECURITY ESTABLISHMENT CANADA (CSEC) 


The Communications Security Establishment Canada (CSEC) is Canada’s national 

_ cryptologic agency. Unique within Canada’s security and intelligence community, CSEC 
_ employs code-makers and code-breakers to provide the Government of Canada with 

_ information technology security and foreign intelligence services. CSEC also provides 

_ technical and operational assistance to federal law enforcement and security agencies. 


| CSEC’s foreign intelligence products and services support government decision-making 
in the fields of national security, national defence and foreign policy. CSEC’s signals 
intelligence activities relate exclusively to foreign intelligence and are directed by the 
Government of Canada’s intelligence priorities. 


CSEC’s information technology security products and services enable its clients 
(government departments and agencies) to effectively secure their electronic information 
systems and networks. CSEC also conducts research and development on behalf of the 
Government of Canada in fields related to communications security. 


CSEC has a three-part mandate under subsection 273.64(1) of the National Defence Act. 
These are known as parts (a), (b) and (c) of its mandate: 


(a) to acquire and use information from the global information infrastructure for 
the purpose of providing foreign intelligence, in accordance with 
Government of Canada intelligence priorities; 

(b) to provide advice, guidance and services to help ensure the protection of 
electronic information and of information infrastructures of importance to 
the Government of Canada; and 

(c) to provide technical and operational assistance to federal law enforcement 
and security agencies in the performance of their lawful duties. 
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Review reports to Minister, 
CSEC and NSA:6, 

- assurance 

- information 

- recommendations 


Sound CSEC 
policies, procedures 
and practices 


Plan, conduct and 

report reviews of 

CSEC’s activities: 
- general mandate 


Annual Reports to 
Minister for tabling 
in Parliament: 

- assurance 

- information 


CSEC accepts and 


implements advice and 
recommendations 
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ANNEX F: OCSEC REVIEW PROGRAM — LOGIC MODEL 


The following logic model provides a graphic description of how the review program 


Plan, conduct and 
report studies of 
CSEC’s activities 


Notifications of Minister 
& AG, re: any possible 
lack of lawfulness of 
CSEC’s activities 


a 


OCSEC helps provide 
. | accountability for 

| Minister responsible 
for CSEC 


i 
2 


MY à 
: 


| 


) | i 


Government and public confidence in the 
lawfulness of CSEC’s activities 


(1) Ministerial authorizations 
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(2) National Security Advisor 
to the Prime Minister 


(3) Attorney General of Canada 
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INTRODUCTION 


By the Honourable Peter deC. Cory, C.C., C.D. 


I was pleased to accept the appointment of Communications Security 
Establishment Commissioner, effective December 14, 2009. The office 
had been without a Commissioner since the untimely death last July of 
my predecessor, and former colleague on the Supreme Court of Canada, 
the late Honourable Charles D. Gonthier. 


Upon my arrival at the office last December, what impressed me 
immediately was the professionalism and dedication of the staff. Despite 
the fact that there had been no Commissioner in place between the 
passing of Mr. Gonthier and my appointment, the work of the office 
continued, with staff carrying on review of the Communications Security 
Establishment Canada (CSEC) activities. The only work that did not 
proceed was the forwarding of review reports to the Minister, a task 
which is the sole responsibility of the Commissioner. 


I was also struck by the professionalism and dedication of CSEC 
personnel. One area of activity in 2009-2010 which stands out is 
CSEC’s important, and at times life-saving, work in support of Canadian 
Forces in Afghanistan, as a priority established by the Government of 
Canada. 


During the time between my appointment and the end of this reporting 
period, I was thoroughly apprised of CSEC’s activities through a 
comprehensive briefing from the Chief of CSEC as well as briefings and 
discussions with my staff pertaining to the review of CSEC’s activities 
to assess compliance with relevant legislation. 


I know from past reports that those CSEC activities that were reviewed 
complied with the law. The opportunity I had for discussions with the 
Chief and with my staff demonstrated to me that there is consistency in 
the way in which CSEC fulfills its mandate. Those activities about 
which I submitted reports to the Minister of National Defence also 
complied with the law. This is a reflection of a culture of compliance 
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that exists within CSEC. 


This is not to say that there are not certain issues about which there are 
or may be disagreements. These disagreements can be worked through 
more effectively, however, when there is a fundamental understanding of 
the law by CSEC staff and a practical appreciation of how it applies to 
their work. 


As a final word, let me state that subsequent to my appointment in late 
2009, a number of factors intervened to lead me to limit my time as 
Commissioner. These are circumstances that I sincerely regret, since the 
process of selection must take time. However, life sometimes sets before 
us circumstances that do not always work out the way we would have 
thought or preferred. I am grateful for the opportunity I had to work with 
the able and conscientious staff at the Commissioner’s office. | am 
assured as well that my successor has a sound base on which to carry 
forward the important, independent role of the Commissioner in 
ensuring that CSEC complies with the law and protects the privacy of 
Canadians while fulfilling its legislated mandate. 


REVIEW ENVIRONMENT 


Proposed amendments to the National 
Defence Act 


The National Defence Act (NDA) prohibits CSEC from directing its 
foreign intelligence and information technology security activities at a 
Canadian or any person in Canada. It also requires CSEC to take 
measures to protect the privacy of Canadians in the use and retention of 
intercepted information. 
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However, due to the manner in which communications are transmitted, 
CSEC may, while conducting its mandated foreign intelligence collection 
or information technology security activities, unintentionally intercept 
communications of Canadians or persons in Canada, which constitute 
“private communications” as per section 183 of the Criminal Code. 


Recognizing this possibility, the NDA allows the Minister of National 
Defence to authorize CSEC to intercept private communications. Prior to 
granting this authorization, however, the Minister must be satisfied that 
certain conditions set out in the NDA are met. There are four conditions 
for foreign intelligence collection ministerial authorizations (subsection 
273.65(2)) and five conditions for information technology security 
ministerial authorizations (subsection 273.65(4)). 


CSEC’s activities conducted under a ministerial authorization must be 
undertaken in accordance with: 


¢ relevant legislation, namely the NDA, Canadian Charter of Rights 
and Freedoms, Privacy Act, Criminal Code, as well as Justice Canada 
advice; 


* requirements set out by the Minister of National Defence in the 
authorization or in a ministerial directive, for example, for 
accountability, to record and report to the Minister certain information 
after the expiration of the ministerial authorization; and 


¢ CSEC policies and procedures. 


Part of the Commissioner’s legislated mandate is to examine CSEC’s 
activities under ministerial authorizations to ensure they were authorized 
and conducted in compliance with the law. Reviews by past 
Commissioners have never identified an instance in which CSEC 
targeted the communications of a Canadian or a person in Canada. 
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Private communications and information about 
Canadians 


Reviews of CSEC activities under ministerial authorizations have consistently 
demonstrated that the proportion of private communications of Canadians 
that CSEC unintentionally intercepts is very small. | 


CSEC’s classified foreign intelligence reports may contain information about 
Canadian citizens, permanent residents or Canadian corporations (as 
defined in section 273.61 of the NDA), if such information is deemed 
essential to the understanding of the reports. However, this information must 
be suppressed, that is replaced by a generic reference such as “a 
Canadian person’. 


CSEC’s foreign intelligence ministerial authorizations are broadly 
written and apply to methods of collecting foreign intelligence rather 
than to individuals. However, Commissioners have been of the view that 
it is not clear that the NDA supports such an approach. Commissioners 
have stated that amendments to the NDA are necessary to clarify 
ambiguities relating to foreign intelligence ministerial authorizations. 
Former Commissioner Gonthier also emphasized last year that “the 
length of time that has passed without producing amended legislation 
puts at risk the integrity of the review process.” 


Commissioner Gonthier was informed by the Minister of National 
Defence that clarification of ambiguities and other amendments to the 
NDA are a legislative priority. Pending amendments, Commissioners 
have continued to use the interim solution of applying a qualified 
opinion, that is, reviewing CSEC foreign intelligence collection 
activities under ministerial authorization on the basis of the NDA as it is 
interpreted by Justice Canada. However, past Commissioners have noted 
they disagree in certain important respects with that interpretation, which 
highlights the need for amendments to the NDA. 
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CSEC assistance to CSIS under part (c) of 
CSEC's mandate and sections 12 and 21 of the 
CSIS Act 


National security matters are increasingly the subject of court and other 
public proceedings. In his October 5, 2009 decision in the matter of an 
application for a warrant pursuant to sections 12 and 21 of the CSIS Act, 
the Honourable Mr. Justice Mosley of the Federal Court authorized 
CSIS, with the technical assistance of CSEC, to intercept from within 
Canada communications pertaining to threat-related activities in which it 
was believed two persons would engage while travelling outside of 
Canada. Justice Mosley distinguished the application from a similar one 
heard and denied in October 2007 by the Honourable Mr. Justice 
Blanchard, also of the Federal Court. 


In the reasons for his decision, Justice Mosley emphasized that “[i]n 
authorizing CSIS, with the technical assistance of CSE[C], to collect 
information ... intercepted in Canada, I am not authorizing CSE[C] to 
overstep its legislative mandate under the National Defence Act. [...] 
CSE[C] will not be directing its activities at Canadian citizens to acquire 
information for its purposes but assisting CSIS”. 


CSEC’s mandate to assist federal law enforcement and 
security agencies 


Paragraph 273.64(1)(c) of the National Defence Act permits CSEC to 


provide technical and operational assistance to federal law enforcement 
and security agencies. CSEC is subject to any limitations imposed by law 
on the agency to which CSEC is providing assistance — for example, 
conditions imposed by a judge in a warrant. 
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In 2010-2011, the Commissioner’s office will conduct a review of 
CSEC’s assistance to CSIS involving the interception in Canada of 
communications of Canadians located outside of Canada and subject to a 
warrant under sections 12 and 21 of the CSIS Act, such as those 
authorized by Justice Mosley’s decision. 


Findings and recommendations arising from 
the lacobucci and O’Connor inquiries 


In June 2009, the House of Commons Standing Committee on Public 
Safety and National Security issued a report of its review of the 
findings and recommendations arising from the /nternal Inquiry into the 
Actions of Canadian Officials in Relation to Abdullah Almalki, Ahmad 
Abou-Elmaati and Muayyed Nureddin (Iacobucci inquiry) and the 
Commission of Inquiry into the Actions of Canadian Officials in 
Relation to Maher Arar (O’ Connor inquiry). The Standing Committee 
urged the government to implement all of the recommendations from 
these inquiries. 


In October 2009, the government responded to the Standing 
Committee’s report with a commitment “...to modernize and strengthen 
the national security review framework”. Specifically, the response 
stated: “‘[t]he Government’s objective is to strengthen national security 
structures that are already in place...” and “[m]uch work has also been 
done to advance policy analysis on Canada’s national security review 
framework ” including “...providing a mechanism to facilitate inter- 
agency review of national security activities”. 


Regarding the latter point, former Commissioner Gonthier stated that 
there are no obstacles, legal or otherwise, to cooperation among national 
security review agencies. Much can be done by way of joint or parallel 
reviews, research or other collaborative work. 
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Respecting the role of parliamentarians, and in the context of the 
development of an enhanced national security framework, the 
government’s response indicated that due consideration will be given to 
the Standing Committee’s fifth recommendation: that Bill C-81, 
introduced in the 38" Parliament, An Act to Establish the National 
Security Committee of Parliamentarians, or a variation of it, be 
introduced in Parliament at the earliest opportunity. Past Commissioners 
have raised questions about the composition of such a committee and its 
access to classified national security information. 


_ The O’Connor and Iacobucci inquiries also identified a number of issues 
respecting Canadian security and intelligence agencies’ sharing of 
information with foreign agencies. The government’s response indicated 
that “[t]he cumulative result of successive commissions of inquiry, reports 
and lessons learned has been the refinement of policies and practices 
surrounding the exchange of information between foreign partners and 
Canada’s national security and intelligence and law enforcement 
communities’. Information sharing is an essential component of CSEC’s 
foreign intelligence program. The Commissioner’s office is currently 
completing a review of this activity. 


In its response to the recommendations of the O’Connor and Iacobucci 
inquiries, the government indicated that it will continue to consider the 
advice of stakeholders. The Commissioner’s office remains willing to 
discuss such matters. 
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YEAR IN REVIEW 


The last reporting year was a unique one for the Commissioner’s office. 
As noted in the introduction, there was no Commissioner for a period of 
five months following the passing of Commissioner Gonthier. 
Nevertheless, the work of the office continued. Reviews and classified 
reports were completed, and others that had been approved by former 
Commissioner Gonthier were continued, or begun, as planned. 


The primary objective of reviews is to assess whether CSEC’s activities 
comply with the law, including the extent to which adequate measures 
are in place to protect the privacy of Canadians. Three classified reports 
were submitted to the Minister during the past year. One was a 
comprehensive study relating to CSEC information technology security 
activities and two were reviews relating to foreign intelligence activities. 


The two reviews found that CSEC complied with the law and ministerial 
requirements and protected the privacy of Canadians. CSEC accepted 
the recommendations made in the reviews and is taking action to address 
them. CSEC is also addressing findings in order to improve its policies 
or practices. 


Implementing recommendations 


since 1997, Commissioners have submitted to the Minister of National 
Defence 55 classified review reports and studies. In total, these reports have 
contained 129 recommendations. CSEC has accepted and implemented 
or is working to address 94 percent (121) of these recommendations. The 
few recommendations that were not accepted or implemented may have 
been in areas surpassed by events or circumstances. In an instance where 
CSEC rejects a recommendation, the Commissioner reviews the reasons 
provided by CSEC, then assesses whether to accept these reasons or to 
pursue the issue, possibly by examining it in even greater depth. 
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Regular review of disclosures of information 
about Canadians 


The Commissioner’s 2008-2009 annual report noted that the 
Commissioner’s office would conduct regular reviews of CSEC’s 
disclosure of information about Canadians to Government of Canada 
clients. For a period of six months last year, the Commissioner’s office 
conducted monthly reviews of all disclosures and found them to comply 
with the law, and with CSEC policies and procedures. Given these 
positive results as well as the positive result of a more comprehensive 
review of disclosures reported in the 2008-2009 annual report, it was 
determined that monthly reviews were not necessary. However, given 
also that this activity lies at the heart of the Commissioner’s mandate, as 
noted by former Commissioner Gonthier last year, an annual review will 
still be conducted. 


Timeliness of CSEC’s responses to information 
requests 


CSEC’s operations in 2009-2010 were affected by a number of 
extraordinary factors and external pressures such as responding to 
international special events. While Commissioners respect that 
operations must be CSEC’s priority, the length of time CSEC took to 
respond to requests for information from the Commissioner’s office this 
past year was at times too long. CSEC is examining ways to better 
support the Commissioner’s review requirements. 


Enabling a higher level of assurance 


During the past year, CSEC provided a number of detailed briefings to 
staff of the Commissioner’s office. Some of the briefings were general in 
nature with the objective of keeping the office informed of operational, 
policy and organizational issues. Other briefings provided information 
on specific CSEC activities prior to establishing terms of reference for a 


review or during a review underway. 
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Several briefings described CSEC’s tools, systems and databases, 
including those used to ensure that CSEC complies with statutory 
requirements for targeting foreign entities outside of Canada. 


The briefings, along with direct access to CSEC systems and front-line 
employees, enhanced the depth of review by the Commissioner’s office 
in 2009-2010. All of this enables a Commissioner to provide a higher 
level of assurance to the Minister of National Defence that CSEC is 
complying with the law and protecting the privacy of Canadians. 


Strengthening accountability and compliance 


Commissioners look to reinforce good practices that maintain or 
strengthen CSEC’s compliance with the law and the protection of the 
privacy of Canadians. CSEC has continued to make significant 
improvements to its information management practices and has 
continued to expand the use of its corporate records management 
system, issues that were subjects of past recommendations by 
Commissioners. These enhancements are critical to CSEC accountability 
and compliance. 


CSEC is also to be commended for a new initiative to increase employee 
awareness and knowledge of the authorities, policies and procedures 
governing its activities. This initiative makes policies which are 
specifically relevant to an employee’s position readily available on the 
employee’s computer. This initiative is expected to strengthen CSEC’s 
compliance framework and the protection of the privacy of Canadians. 
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REVIEW METHODOLOGY 


In the conduct of a review, the Commissioner’s staff examine relevant 
written and electronic records, files, correspondence and other 
documentation, including policies, procedures and legal advice. CSEC 
provides briefings and demonstrations of its activities as well as detailed 
answers in response to written questions from the Commissioner’s office. 


Commissioner’s staff may test the information obtained against the 
contents of CSEC systems and databases. In addition, Commissioner’s 
staff interview CSEC managers and other personnel involved in activities 
under review and observe firsthand CSEC operators and analysts to learn 
exactly how they are conducting their work. 


The Commissioner’s office may also refer to the work of CSEC’s 
internal auditors and evaluators. In some cases, this may lead to 
identifying an activity for review. 


Review criteria 


Reviews conducted by the Commissioner’s office include an assessment 
of CSEC’s activities against a standard set of criteria respecting legal 
requirements, ministerial requirements, and CSEC policies and 
procedures. Other criteria may be added to each review, as appropriate. 


Legal requirements: The Commissioner expects CSEC to conduct an 
activity in accordance with the NDA, the Canadian Charter of Rights 
and Freedoms, Privacy Act, Criminal Code, any other relevant 
legislation and Justice Canada advice. 
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Ministerial requirements: The Commissioner expects CSEC to conduct 
an activity in a manner that is in accordance with ministerial direction, 
namely any requirements and limitations set out in a ministerial 
authorization or directive. 


Policies and Procedures: The Commissioner expects CSEC to have 
appropriate policies and procedures in place to guide an activity and to 
provide sufficient direction respecting legal and ministerial requirements 
and the protection of the privacy of Canadians. The Commissioner 
expects CSEC employees to be aware of and comply with policies and 
procedures. The Commissioner also expects CSEC to utilize an effective 
management control framework to ensure that the integrity and lawful 
compliance of an activity is maintained on a routine basis. This includes 
appropriate accounting for decisions taken and for information relating 
to compliance and the protection of the privacy of Canadians. 


A new approach fo reviewing foreign 
intelligence activities 


CSEC’s foreign intelligence collection activities conducted under 
ministerial authorization involve a number of distinct methods of 
acquiring information from the global information infrastructure. 
Nevertheless, there are a number of common processes and associated 
tools, as well as common systems and databases, which support these 
collection methods and which CSEC uses to deal with the information 
obtained. For example, common to all of the collection methods are the 
processes by which CSEC: selects foreign entities located outside 
Canada that are of foreign intelligence interest; shares reports and 
information with its clients and international partners; and retains or 
disposes of intercepted communications. 
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Rather than examine thoroughly individual ministerial authorizations, it 
was assessed as more effective to examine thoroughly each process 
common to CSEC’s foreign intelligence collection activities under 
ministerial authorization. This new approach, which cuts across the 
collection methods, is referred to as horizontal review. 


Why horizontal review? 


The horizontal review approach, born of years of accumulated review 
experience on the part of the Commissioner's office, is designed to provide 
the Commissioner's staff with an even more comprehensive understanding 
of how CSEC conducts its activities. Ultimately, its objective is to increase the 
degree of assurance the Commissioner can provide to the Minister of 
National Defence that CSEC is complying with the law and protecting the 
privacy of Canadians. 


In addition to the horizontal review approach, the Commissioner’s office 
now reviews all foreign intelligence ministerial authorizations together, 
on an annual basis. This review will identify any significant changes to 
the activities covered by the ministerial authorizations or in the 
authorizations themselves. Any significant changes will be assessed in 
terms of their impact on risks of non-compliance and risks to the privacy 
of Canadians. If appropriate, a detailed review will be conducted. This 
annual review of foreign intelligence ministerial authorizations will also 
examine used and retained intercepted private communications to ensure 
they are communications essential to international affairs, defence or the 
security of Canada, as required by paragraph 273.65(2)(d) of the NDA. 
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The Commissioner provides classified reports containing findings and 
recommendations to the Minister of National Defence, with copies going 
to the Chief of CSEC, to the National Security Advisor to the Prime 
Minister, who is accountable for CSEC operations and policy, and to the 
Deputy Minister of National Defence, who is accountable for 
administrative matters pertaining to CSEC. Prior to finalizing a report, 
the Commissioner’s office seeks CSEC’s comments respecting the 
report’s factual accuracy. 


Study of CSEC information technology security 
activities not conducted under ministerial 
authorization 


Background 

This study was initiated and conducted under the authority of former 
Commissioner Gonthier, as articulated in paragraph 273.63(2)(a) of the 
NDA. It examined CSEC information technology (IT) security activities 
not conducted under ministerial authorization. A previous review of IT 
security activities was conducted in 2000. However, because of significant 
changes and developments in this area since that time, a comprehensive 
study was undertaken of all IT security activities not conducted under 
ministerial authorization. Other IT security activities that CSEC conducts 
under ministerial authorizations are reviewed annually. 


CSEC’s principal authority for IT security is derived from paragraph 
273.64 (1)(b) of the NDA: “to provide advice, guidance and services to 
help ensure the protection of electronic information and of information 
infrastructures of importance to the Government of Canada”. CSEC’s IT 
security activities focus on preventing and responding to sophisticated 
IT threats and cyber attacks that attempt to covertly access sensitive 
government computer systems. Among its IT security activities, CSEC 
promotes sound security practices to help government departments 
reduce IT vulnerabilities and manage IT security risks. This may involve 
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the provision of monitoring and countermeasures to prevent, detect and 
respond to IT threats and cyber attacks. 


The objectives of the study were to acquire knowledge of CSEC IT 
security activities and to conduct a risk assessment to determine which 
of these activities, if any, may raise issues about compliance with the 
law, ministerial requirements, CSEC policy and procedures, or the 
protection of the privacy of Canadians — and should therefore be subject 
to follow-up review. Particular attention was paid to activities that may 
involve private communications or information about Canadians. 


Some of the areas included in the scope of this study were: the 
government’s cryptographic program; relationships with industry; 
research, analysis and reporting respecting cyber vulnerabilities and 
sophisticated IT threats and attacks; assistance in identifying and 
responding to vulnerabilities and incidents affecting information 
infrastructures of importance to the government; and associated 
relationships with key Canadian government and international partners. 


Findings and conclusions 

The study found that CSEC IT security activities not conducted under 
ministerial authorization generally present a low risk of possible non- 
compliance with Part V.1 of the NDA and a low risk to the privacy of 
Canadians. One quarter of the areas included in the study were identified 
for follow-up review and have been incorporated into the Commissioner’s 
three-year work plan. 


In only a few cases, CSEC’s IT security activities not conducted under 
ministerial authorization involve access to a small amount of 
information about Canadians. Most of this information relates to the 
identity of a Canadian company, or consists of information voluntarily 
provided by CSEC’s government clients as part of cyber protection 
activities or ongoing Crown business. 
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There are, however, other IT security activities not conducted under 
ministerial authorization that may present risks to the privacy of 
Canadians. These activities are conducted under the Criminal Code and 
the Financial Administration Act authorities of other government entities 
and may involve CSEC access to private communications and 
information about Canadians. In respect of these activities, the study 
found that CSEC takes measures to protect the privacy of Canadians. For 
example, private communications and information about Canadians are 
disclosed only to those officials involved in protecting computer 
systems. Nevertheless, the potential risks to privacy presented by these 
activities cannot be discounted. Therefore, the Commissioner’s office 
will conduct in-depth reviews of these activities to verify CSEC’s 
compliance, and to assess the extent to which it protects the privacy of 
Canadians in carrying out these activities. 


Intrusion detection system monitoring 


Paragraph 184(2)(e) of the Criminal Code permits in part the interception of 
a private communication by a person in control of a computer system in 
order to protect the computer system from any act that would be an offence 
under subsections 342.1(1) (‘unauthorized use of computer”) or 430(1.1) 
(“mischief in relation to data”) of the Criminal Code. This provision permits 
the use of an intrusion detection system to protect against a cyber attack 
and allows for the use or retention of a private communication where it is 
essential to identify, isolate or prevent harm to the computer system. 


Section 161 of the Financial Administration Act provides authority for a 
government entity to take reasonable measures to protect a computer 
system, including the interception of a private communication in 

circumstances specified in paragraph 184(2)(e) of the Criminal Code. 
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The study also included the examination of a principal CSEC IT security 
software tool and information repository. Former Commissioner 
Gonthier concluded that the CSEC IT security software tool has 
adequate functionality to restrict access to information held in the 
system, to meet security and confidentiality requirements, and to protect 
the privacy of Canadians. To confirm this, the Commissioner’s office 
examined CSEC’s use of the system in the context of a review of certain 
IT security activities conducted under ministerial authorization. The 
results of this review will be included in the 2010-2011 annual report. 


Review of CSEC foreign intelligence collection 
activities conducted under ministerial 
authorizations and in support of government 
efforts relating to Afghanistan 


Background 

This review was initiated and conducted under the authority of former 
Commissioner Gonthier, as articulated in subsection 273.65(8) of the 
NDA. The report was reviewed and submitted to the Minister of National 
Defence by former Commissioner Cory. The review examined activities 
conducted under two ministerial authorizations in effect in 2006-2007 
and 2007—2008 and in support of Canadian Forces military operations 
and other government efforts relating to Afghanistan. CSEC obtained the 
ministerial authorizations pursuant to subsections 273.65(1) and (2) of 
the NDA because, in carrying out the activities, it was possible that 
CSEC might intercept a communication that either originated or 
terminated in Canada, constituting a private communication, as defined 
in the Criminal Code. 
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Pending amendments to clarify the NDA, this review was based on the 
legal interpretation of the foreign intelligence ministerial authorization 
provisions in the NDA provided to CSEC by Justice Canada. 


As this was the first review of these activities, the objectives were to 
acquire detailed knowledge of these activities, to assess whether these 
activities were authorized and complied with the law, and to assess the 
extent to which CSEC protected the privacy of Canadians in carrying out 
these activities. 


Findings 

It is clear that CSEC’s activities under ministerial authorization and 
relating to Afghanistan provide important access to valuable foreign 
intelligence that supports both military and broader government 
intelligence priorities. 


The activities were found to have involved access to a minimal number 
of private communications and information about Canadians. They were 
therefore assessed as presenting a low risk to the privacy of Canadians. 


Based on information reviewed and interviews conducted, CSEC 
activities from 2006-2008 under ministerial authorization and relating to 
Afghanistan were found to have been appropriately authorized and 
conducted in accordance with the law and Justice Canada advice. These 
activities were also found to have been conducted in accordance with 
requirements in the ministerial authorizations and with ministerial 
direction. CSEC recorded and reported information to the Minister in 
accordance with the requirements of the authorizations. 
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Recommendations 

No information or documentation was found to indicate that CSEC 
employees contravened operational policies and procedures applicable to 
these foreign intelligence collection activities. However, former 
Commissioner Gonthier recommended that CSEC amend its policy for 
these activities to clarify certain obligations. It is a positive development 
that CSEC acted on this recommendation and, as a result, has 
strengthened its ability to meet legal and ministerial requirements. The 
Commissioner’s office will also monitor CSEC efforts to address gaps 
related to CSEC’s dealings with the Canadian Forces, as identified by 
CSEC internal evaluators. 


In addition, this review noted two CSEC enhancements related to 
foreign intelligence collection reporting that should be recognized. 
First, CSEC took action to centrally manage a certain type of reporting 
to enhance accountability for such reporting. Second, CSEC addressed 
a recommendation by former Commissioner Gonthier that additional 
information respecting foreign intelligence collection activities be 
recorded and reported to the Minister of National Defence to 
strengthen accountability. 


Regular review of CSEC disclosure of 
information about Canadians to Government 
of Canada clients 


Background 

This review was initiated and conducted under the authority of former 
Commissioner Gonthier, as articulated in paragraph 273.63(2)(a) of the 
NDA. The report was reviewed and submitted to the Minister of National 
Defence by former Commissioner Cory. 
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When receiving a request for disclosure of the details of suppressed 
information about a Canadian in a report, CSEC requires its clients to 
explain their authority to obtain and use this information, and to 
provide an operational justification of their need for such information. 
Only after these conditions have been met will CSEC release the 
suppressed information. 


The Commissioner’s 2008-2009 annual report contained a summary of a 
comprehensive review of disclosure of information about Canadians to 
Government of Canada clients. The review found that CSEC activities 
complied with law, and with CSEC policies and procedures. Subsequently, 
CSEC suggested that reviews of this activity could be conducted at regular 
intervals. Recognizing that this CSEC activity is important to privacy 
protection, former Commissioner Gonthier agreed with CSEC’s 
suggestion and monthly reviews of all CSEC disclosures to Government 
of Canada clients were conducted from January to June 2009. 


Findings 

The monthly reviews found that CSEC’s disclosure of information about 
Canadians in foreign intelligence reports to Government of Canada 
clients complied with the law and with CSEC operational policies and 
procedures. Given these positive results, it was determined that monthly 
reviews were not necessary and not the most effective use of resources 
for either party. However, given the privacy implications of this activity, 
commencing in 2010-2011, the Commissioner will conduct an annual 
review of arandom sample of disclosures to verify that CSEC continues 
to comply with the law and maintains measures that protect the privacy 
of Canadians. 
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Recommendations 

Notwithstanding the positive findings, former Commissioner Gonthier 
made two recommendations respecting reporting to the Minister of 
National Defence on the volume of information about Canadians 
released to CSEC’s clients. The recommendations relate to providing 
tools to support the tracking of such information and to improving the 
consistency and accuracy of the reporting. CSEC has accepted and is 
implementing the recommendations. 


WORK PLAN — REVIEWS UNDERWAY AND 
PLANNED 


CSEC activities selected for review are prioritized using a set of detailed 
criteria. For example, the ongoing review of CSEC’s foreign intelligence 
sharing with international partners was identified as a high-priority 
review topic. This 1s because: there have been changes to the authorities 
and technologies relating to these activities; the amount of foreign 
intelligence CSEC provides to and receives from its international 
partners is significant; these activities could directly and adversely affect 
a Canadian; specific and important controls are placed on the activities 
to ensure compliance with legal, ministerial and policy requirements, 
and these controls should be examined; and, finally, in past reviews 
relating to these activities, Commissioners have made findings and 
recommendations which require follow-up. 


Decisions respecting the selection and prioritization of subjects for 
review are documented in the Commissioner’s three-year work plan, 
which is updated regularly as part of an ongoing process of assessing risk. 
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Current reviews 


The results of several reviews currently underway are expected to be 
reported on to the Minister of National Defence in the coming year and 
included in the Commissioner’s 2010-2011 public annual report. 


The subjects of these reviews include: CSEC’s foreign intelligence 
sharing with international partners; activities conducted under IT 
security ministerial authorizations; the process by which CSEC 
determines that targets of foreign intelligence interest are foreign entities 
located outside of Canada, as required by the NDA; a method used by 
CSEC to identify new entities believed to be of foreign intelligence 
interest; and an annual review of foreign intelligence ministerial 
authorizations, including a sample of associated private 
communications. 


Upcoming reviews 


Other reviews planned for 2010-2011 include: assistance to CSIS under 
part (c) of CSEC’s mandate and sections 12 and 21 of the CS/S Act; an 
annual review of CSEC disclosures of information about Canadians to 
government clients and international partners; CSEC’s retention and 
disposal of information, and, in particular, of private communications 
and information about Canadians; and CSEC assistance to CSIS under 
part (c) of CSEC’s mandate and sections 16 and 21 of the CSJS Act. 
Some reviews may carry over into the 2011-2012 fiscal year. 


COMPLAINTS ABOUT CSEC’S ACTIVITIES 


The Commissioner’s mandate includes undertaking any investigation 
deemed to be necessary in response to a complaint in order to determine 
whether CSEC has engaged, or is engaging, in unlawful activity. 


In 2009-2010, correspondence was received concerning CSEC activities 
but none warranted investigation. 
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DUTIES UNDER THE SECURITY OF INFORMATION 
ACT 


The Commissioner has a duty under the Security of Information Act to 
receive information from persons who are permanently bound to secrecy 
seeking to defend the release of special operational information on the 
grounds that it is in the public interest. No such matters were reported to 
the Commissioner in the 2009-2010 reporting period. 


THE COMMISSIONER'S OFFICE 


Last year, the Commissioner’s office was granted its own appropriation 
from Parliament, strengthening the Commissioner’s independence. As a 
result of the independence, there were additional administrative 
requirements. The Commissioner’s office then requested and received 
additional funding from the Treasury Board to meet these administrative 
requirements as well as to provide additional operational support for 
fulfilling the Commissioner’s mandate. 


Comparative study of CSEC and international 
partners 


During the summer of 2009 the Commissioner’s office was fortunate to 
welcome a master’s student from Carleton University who completed a 
comparative study of publicly available information respecting CSEC 
and some of its international partners, their authorities, activities and 
oversight and review mechanisms. The study informs work such as the 
ongoing classified review of CSEC’s foreign intelligence sharing with 
international partners. 
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Canadian Association of Security and 
Intelligence Studies (CASIS) conference 


In October 2009 staff of the Commissioner’s office participated in the 
annual CASIS conference, held in Ottawa. The theme of the conference 
was Terrorism, Cyberspies and a New ‘Cold’ War: Emerging Challenges 
for Security and Intelligence. The conference attracted many leading 
experts, scholars, policy makers, practitioners and academics from 
within Canada and internationally. Lectures and panels provided new 
perspectives on the ever broadening challenges facing the security and 
intelligence community. 


International Intelligence Review Agencies 
Conference (IRAC) 


In March 2010, the Executive Director of the Commissioner’s office 
attended the IIRAC in Sydney, Australia, leading a discussion on 
effective review, with a description of the Commissioner’s office’s 
approach in areas such as staff recruitment and development, review 
targeting and plans, and performance measurement and indicators. 


The objectives of the bi-annual IIRAC are to share ideas and best 
practices and build capacity in the review and oversight functions of 
participating organizations. Participants are from countries that share 
basic principles of rule of law and democratic control over security and 
intelligence agencies. Participating organizations represent many 
different models of review and oversight, adding to the richness of 
exchanges of information and experience. 
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(by the Honourable Peter deC. Cory) 


I would like to take this opportunity to say a word about Joanne Weeks, who 
stepped down recently as Executive Director of the Commissioner’s office. 
She had directed the day-to-day business of the office since the appointment 
of the first Commissioner, the Honourable Claude Bisson, in 1996. Joanne 
oversaw an important evolution of the office when a legislative framework 
was provided for both the Commissioner’s office and CSEC in the omnibus 
Anti-terrorism Act, following the terrorist attacks of September 11, 2001. For 
the relatively short time that I worked with Joanne, I came to appreciate her 
clear devotion to public service and saw her as a generous, warm-hearted 
individual. Joanne knew the important role that review plays and strove to 
ensure that she had the most capable staff to carry out the work. As her 
retirement approaches, I would like to express my sincere appreciation and 
thanks to Joanne for her dedication, not just to the Office of the CSE 
Commissioner but, more importantly, to Canada. Her work provides an 
outstanding example to all in the public service. 


A TRIBUTE TO THE HONOURABLE CHARLES 
DOHERTY GONTHIER, C.C., Q.C. 


(by the Honourable Peter deC. Cory) 


The Honourable Charles Doherty Gonthier passed away on July 17, 2009, 
while still Commissioner of the Communications Security Establishment 
Canada. Active to the end in service to his country, and applying his 
intellect with customary vigour, he contributed significantly in many 
areas of the law. His interest and work in later years dealt with sustainable 
development, demonstrating a great social conscience and sympathy for 
vulnerable members of society. 


Charles and I were appointed to the Supreme Court of Canada on the 
same day in 1989. A greatly respected colleague and a close friend, he 
will be sorely missed. Fortunately, he leaves a rich legacy which will 
inspire all of us for the rest of our days. 
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ANNEX A: MANDATE OF THE COMMUNICATIONS SECURITY 
ESTABLISHMENT COMMISSIONER 


National Defence Act — Part V.1 


273.63 (1) The Governor in Council may appoint a supernumerary judge or a retired 
judge of a superior court as Commissioner of the Communications Security 
Establishment to hold office, during good behaviour, for a term of not more 
than five years. 


(2) The duties of the Commissioner are 


(a) to review the activities of the Establishment to ensure that they are in 
compliance with the law; 


(b) in response to a complaint, to undertake any investigation that the 
Commissioner considers necessary; and 


(c) to inform the Minister and the Attorney General of Canada of any 
activity of the Establishment that the Commissioner believes may not be 
in compliance with the law. 


(3) The Commissioner shall, within 90 days after the end of each fiscal year, 
submit an annual report to the Minister on the Commissioner’s activities and 
findings, and the Minister shall cause a copy of the report to be laid before 
each House of Parliament on any of the first 15 days on which that House is 
sitting after the Minister receives the report. 


(4) In carrying out his or her duties, the Commissioner has all the powers of a 
commissioner under Part II of the /nquiries Act. 


(5) The Commissioner may engage the services of such legal counsel, technical 
_ advisers and assistants as the Commissioner considers necessary for the 
proper performance of his or her duties and, with the approval of the 
Treasury Board, may fix and pay their remuneration and expenses. 
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(6) The Commissioner shall carry out such duties and functions as are assigned 
to the Commissioner by this Part or any other Act of Parliament, and may 
carry out or engage in such other related assignments or activities as may be 
authorized by the Governor in Council. 


(7) The Commissioner of the Communications Security Establishment holding 
office immediately before the coming into force of this section shall continue 
in office for the remainder of the term for which he or she was appointed. 


ie 


273.65 (8) The Commissioner of the Communications Security Establishment shall review 
activities carried out under an authorization issued under this section to ensure 
that they are authorized and report annually to the Minister on the review. 


Security of Information Act 


15. (1) No person is guilty of an offence under section 13 or 14 if the person establishes 
that he or she acted in the public interest. [...] 


(5) A judge or court may decide whether the public interest in the disclosure 
outweighs the public interest in non-disclosure only if the person has complied 
with the following: [...] 


(b) the person has, if he or she has not received a response from the deputy head 
or the Deputy Attorney General of Canada, as the case may be, within a 
reasonable time, brought his or her concern to, and provided all relevant 
information in the person’s possession to, [...] 


(ii) the Communications Security Establishment Commissioner, if the 
person’s concern relates to an alleged offence that has been, is being or 
is about to be committed by a member of the Communications Security 
Establishment, in the purported performance of that person’s duties and 
functions of service for, or on behalf of, the Communications Security 
Establishment, and he or she has not received a response from the 
Communications Security Establishment Commissioner within a 
reasonable time. 
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ANNEX B: CLASSIFIED REPORTS TO THE MINISTER 


Le 


x 


10. 


ml. 


12. 


2009-2010 


Principal vs. agent status — March 3, 1997 (TOP SECRET) 

Operational policies with lawfulness implications — February 6, 1998 (SECRET) 
CSE’s activities under *** — March 5, 1998 (TOP SECRET Codeword/CEO) 
Internal investigations and complaints — March 10, 1998 (SECRET) 

CSE’s activities under *** — December 10, 1998 (TOP SECRET/CEO) 


On controlling communications security (COMSEC) material — May 6, 1999 
(TOP SECRET) 


How we test (A classified report on the testing of CSE’s signals intelligence 
collection and holding practices, and an assessment of the organization’s efforts to 
safeguard the privacy of Canadians) — June 14, 1999 (TOP SECRET 
Codeword/CEO) 


A study of the *** collection program — November 19, 1999 
(TOP SECRET Codeword/CEO) 


On *** — December 8, 1999 (TOP SECRET/COMINT) 


A study of CSE’s *** reporting process — an overview (Phase I) 
— December 8, 1999 (SECRET/CEO) 


A study of selection and *** — an overview — May 10, 2000 
(TOP SECRET/CEO) 


CSE’s operational support activities under *** — follow-up — May 10, 2000 
(TOP SECRET/CEO) 


Internal investigations and complaints — follow-up — May 10, 2000 
(SECRET) 


On findings of an external review of CSE’s ITS program — June 15, 2000 
(SECRET) 


CSE’s policy system review — September 13, 2000 (TOP SECRET/CEO) 
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30. 


30 


A study of the *** reporting process — *** (Phase IT) — April 6, 2001 
(SECRET/CEO) 


A study of the *** reporting process — *** (Phase IT) — April 6, 2001 
(SECRET/CEO) 


CSE’s participation *** — August 20, 2001 (TOP SECRET/CEO) 


CSE’s support to ***, as authorized by *** and code-named *** — August 20, 2001 
(TOP SECRET/CEO) 


A study of the formal agreements in place between CSE and various external 
parties in respect of CSE’s Information Technology Security (ITS) 
— August 21, 2002 (SECRET) 


CSE’s support to ***, as authorized by *** and code-named *** 
— November 13, 2002 (TOP SECRET/CEO) 


CSE’s *** activities carried out under the *** 2002 *** Ministerial authorization 
— November 27, 2002 (TOP SECRET/CEO) 


Lexicon of CSE definitions — March 26, 2003 (TOP SECRET) 


CSE’s activities pursuant to *** Ministerial authorizations including ci 
= May 20, 2003 (SECRET) 


CSE’s support to ***, as authorized by *** and code-named *** — Part I 
— November 6, 2003 (TOP SECRET/COMINT/CEO) 


CSE’s support to ***, as authorized by *** and code-named *** — Part II 
— March 15, 2004 (TOP SECRET/COMINT/CEO) 


A review of CSE’s activities conducted under *** Ministerial authorization 
— March 19, 2004 (SECRET/CEO) 


Internal investigations and complaints — follow-up — March 25, 2004 
(TOP SECRET/CEO) 


A review of CSE’s activities conducted under 2002 *** Ministerial authorization 
— April 19, 2004 (SECRET/CEO) 


Review of CSE *** operations under Ministerial authorization — June 1, 2004 
(TOP SECRET/COMINT) 


ANNUAL REPORT 


So Te ESS EI aU SSS OR RESET 


pl. 


Be) 


pS. 
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58. 


29. 


40. 


41. 


42. 


43. 


44, 


45. 


2009-2010 


CSE’s support to *** — January 7, 2005 (TOP SECRET/COMINT/CEO) 


External review of CSE’s *** activities conducted under Ministerial authorization 
— February 28, 2005 (TOP SECRET/COMINT/CEO) 


A study of the *** collection program — March 15, 2005 (TOP SECRET/ 
COMINT/CEO) 


Report on the activities of CSE’s *** — June 22, 2005 (TOP SECRET) 


Interim report on CSE’s *** operations conducted under Ministerial authorization 
— March 2, 2006 (TOP SECRET/COMINT) 


External review of CSE *** activities conducted under Ministerial authorization 
— March 29, 2006 (TOP SECRET/CEO) 


Review of CSE’s foreign intelligence collection in support of the RCMP (Phase II) 
— June 16, 2006 (TOP SECRET/COMINT/CEO) 


Review of information technology security activities at a government department 
under ministerial authorization — December 18, 2006 (TOP SECRET) 


Review of CSE signals intelligence collection activities conducted under ministerial 
authorizations (Phase I) — February 20, 2007 (TOP SECRET/COMINT/CEO) 


Role of the CSE's client relations officers and the Operational Policy Section in the 
release of personal information — March 31, 2007 (TOP SECRET/COMINT/CEO) 


Review of information technology security activities at a government department 
under ministerial authorization — July 20, 2007 (TOP SECRET) 


Review of CSEC’s counter-terrorism activities — October 16, 2007 (TOP SECRET/ 
COMINT/CEO) 


Review of CSEC’s activities carried out under a ministerial directive 
— January 9, 2008 (TOP SECRET/COMINT/CEO) 


Review of CSEC’s support to CSIS — January 16, 2008 (TOP SECRET/ 
COMINT/ CEO) 


Review of CSEC signals intelligence collection activities conducted under 
ministerial authorizations (Phase II) — March 28, 2008 (TOP SECRET? 
COMINT/CEO) 
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Review of CSEC’s acquisition and implementation of technologies as a means to 
protect the privacy of Canadians — June 11, 2008 (TOP SECRET/COMINT/CEO) 


Review of CSEC foreign intelligence collection activities conducted under 
ministerial authorizations (Activity 1) — June 11, 2008 (TOP SECRET/ 
COMINT/CEO) 


Review of disclosure of information about Canadians to Government of Canada 
clients —- November 19, 2008 (TOP SECRET/COMINT/CEO) 


Review of CSEC foreign intelligence collection activities conducted under 
ministerial authorizations (Activity 2) — January 13, 2009 (TOP SECRET? 
COMINT/CEO) 


Review of CSEC foreign intelligence collection activities conducted under a 
ministerial directive and ministerial authorizations (Activity 3) — February 26, 2009 
(TOP SECRET/COMINT/CEO) 


Review of CSEC activities conducted under a ministerial directive and in support 
of its foreign intelligence collection mandate — March 12, 2009 (TOP SECRET/ 
COMINT Codeword/CEO) 


Follow-up to a recommendation in a 2007—2008 review of CSEC activities carried 
out under a ministerial directive — March 12, 2009 (TOP SECRET/COMINT/CEO) 


Study of CSEC information technology security activities not conducted under 
ministerial authorization — June 11, 2009 (TOP SECRET/COMINT/CEO) 


Review of CSEC foreign intelligence collection activities conducted under 
ministerial authorizations and in support of government efforts relating to 
Afghanistan — January 18, 2010 (TOP SECRET/COMINT/CEO) 


Regular review of CSEC disclosure of information about Canadians to Government 
of Canada clients — February 16, 2010 (TOP SECRET/COMINT/CEO) 
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ANNEX C: STATEMENT OF EXPENDITURES 2009-2010 


Standard Object Summary 

Salaries and Wages $930,329 
Transportation and Telecommunications 5005 
Information 19,319 
Professional and Special Services 378,465 
Rentals 157,068 
Purchased Repairs and Maintenance 457 
Materials and Supplies 11,042 
Total $1,532,573 
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ANNEX D: HISTORY OF THE OFFICE OF THE 
COMMUNICATIONS SECURITY ESTABLISHMENT 
COMMISSIONER 


The Office of the Communications Security Establishment Commissioner was created 
on June 19, 1996, with the appointment of the inaugural Commissioner, the 
Honourable Claude Bisson, O.C., a former Chief Justice of Québec, who held the 
position until June 2003. He was succeeded by the late Right Honourable Antonio 
Lamer, P.C., C.C., C.D., LL.D., D.U., former Chief Justice of Canada, for a term of 
three years. The Honourable Charles D. Gonthier, C.C., Q.C., who retired as Justice of 
the Supreme Court of Canada in 2003, was appointed as Commissioner in August 
2006, a position he held until his death in July 2009. The Honourable Peter deC. Cory, 
C.C., C.D., a former Justice of the Supreme Court of Canada, served as Commissioner 
from December 14, 2009 to March 31, 2010. 


For the first six years (from June 1996 to December 2001), the Commissioner carried out 
his duties under the authority of Orders in Council issued pursuant to Part II of the 
Inquiries Act. During this period, the Commissioner’s responsibilities were twofold: to 
review the activities of the Communications Security Establishment Canada (CSEC) to 
determine whether they conformed with the laws of Canada; and to receive complaints 
about CSEC’s activities. 


Following the terrorist attacks in the United States on September 11, 2001, Parliament 
adopted the omnibus Anti-terrorism Act, which came into force on December 24, 2001. 
The omnibus Act introduced amendments to the National Defence Act by adding Part V.1 
and creating legislative frameworks for both the Commissioner’s office and CSEC. It 
gave the Commissioner new responsibilities to review activities carried out by CSEC 
under a ministerial authorization. The legislation also continued the Commissioner’s 
‘powers under the /nquiries Act. 
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TRE 
The omnibus legislation also introduced the Security of Information Act, which replaced 
the Official Secrets Act. This legislation gives the Commissioner specific duties in the 
event that a person, who would otherwise be permanently bound to secrecy, seeks to 
defend the release of classified information about CSEC on the grounds that it is in the 


public interest. 


In autumn 2007, a decision was taken that would sever the Commissioner’s office’s long- | 
standing arrangements with the Privy Council Office for administrative and other support ! 


activities. Effective April 1, 2009, the Commissioner’s office was granted its own 
parliamentary appropriation. While the Commissioner continues to provide the Minister 


of National Defence with his reports, the Commissioner’s office is separate from, and not | 


part of, the Department of National Defence. 
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ANNEX E: ROLE AND MANDATE OF THE COMMUNICATIONS 
SECURITY ESTABLISHMENT CANADA (CSEC) 


The Communications Security Establishment Canada (CSEC) is Canada’s national 
cryptologic agency, providing the Government of Canada with two key services, foreign 
signals intelligence and information technology security. CSEC also provides technical 
and operational assistance to federal law enforcement and security agencies. 


CSEC’s foreign intelligence products and services support government decision-making 
in the fields of national security, national defence and foreign policy. CSEC’s signals 
intelligence activities relate exclusively to foreign intelligence and are directed by the 
Government of Canada’s intelligence priorities. 


CSEC’s information technology security products and services enable government 
departments and agencies to secure their electronic information systems and networks. 
CSEC also conducts research and development on behalf of the Government of Canada 
in fields related to communications security. 


CSEC’s three-part mandate is set out in subsection 273.64(1) of the National Defence 
Act: 


(a) to acquire and use information from the global information infrastructure for 
the purpose of providing foreign intelligence, in accordance with 
Government of Canada intelligence priorities; 


(b) to provide advice, guidance and services to help ensure the protection of 
electronic information and of information infrastructures of importance to 
the Government of Canada; and 


(c) to provide technical and operational assistance to federal law enforcement 
and security agencies in the performance of their lawful duties. 
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The following logic model provides a graphic description of how the review program 


functions. 


ACTIVITIES 


OUTPUTS 


OUTCOMES 


(Final) <—— (Intermediate) -«=———— (Immediate) 


Reports to Minister of 
National Defence, CSEC 
and National Security 
Advisor to Prime Minister 


- recommendations 


Plan, conduct and report reviews 


and studies of CSEC’s activities 


Notifications to Minister 
of National Defence and 
Attorney General of any 
CSEC activity that may 


Annual Reports to 
Minister of National 
Defence for tabling 

in Parliament: 


- assurance - assurance not be in compliance 
- information - information with the law 
- findings 


Support for Minister 
of National Defence 
in his accountability 
for CSEC 


CSEC activities 
based on sound 
policies, procedures 
and practices 


CSEC accepts and 
implements advice and 
recommendations 


Low CSEC susceptibility to, and 
incidence of, lack of compliance 
with the law; high level of 

safeguarding privacy 


Government and public confidence in the 


lawfulness of CSEC’s activities 
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